+ # (b) figure whether we are PI for the authority where we belong
+ self.logger.info("Resolving our own id %s"%self.user)
+ my_records=self.registry().Resolve(self.user,self.my_credential_string)
+ if len(my_records)!=1: print "Cannot Resolve %s -- exiting"%self.user; sys.exit(1)
+ my_record=my_records[0]
+ my_auths_all = my_record['reg-pi-authorities']
+ self.logger.info("Found %d authorities that we are PI for"%len(my_auths_all))
+ self.logger.debug("They are %s"%(my_auths_all))
+
+ my_auths = my_auths_all
+ if options.delegate_auths:
+ my_auths = list(set(my_auths_all).intersection(set(options.delegate_auths)))
+ self.logger.debug("Restricted to user-provided auths"%(my_auths))
+
+ # (c) get the set of slices that we are in
+ my_slices_all=my_record['reg-slices']
+ self.logger.info("Found %d slices that we are member of"%len(my_slices_all))
+ self.logger.debug("They are: %s"%(my_slices_all))
+
+ my_slices = my_slices_all
+ # if user provided slices, deal only with these - if they are found
+ if options.delegate_slices:
+ my_slices = list(set(my_slices_all).intersection(set(options.delegate_slices)))
+ self.logger.debug("Restricted to user-provided slices: %s"%(my_slices))
+
+ # (d) make sure we have *valid* credentials for all these
+ hrn_credentials=[]
+ hrn_credentials.append ( (self.user, 'user', self.my_credential_string,) )
+ for auth_hrn in my_auths:
+ hrn_credentials.append ( (auth_hrn, 'auth', self.authority_credential_string(auth_hrn),) )
+ for slice_hrn in my_slices:
+ hrn_credentials.append ( (slice_hrn, 'slice', self.slice_credential_string (slice_hrn),) )
+
+ # (e) check for the delegated version of these
+ # xxx todo add an option -a/-A? like for 'sfi delegate' for when we ever
+ # switch to myslice using an authority instead of a user
+ delegatee_type='user'
+ delegatee_hrn=myslice_dict['delegate']
+ hrn_delegated_credentials = []
+ for (hrn, htype, credential) in hrn_credentials:
+ delegated_credential = self.client_bootstrap.delegate_credential_string (credential, delegatee_hrn, delegatee_type)
+ # save these so user can monitor what she's uploaded
+ filename = os.path.join ( self.options.sfi_dir,
+ "%s.%s_for_%s.%s.cred"%(hrn,htype,delegatee_hrn,delegatee_type))
+ with file(filename,'w') as f:
+ f.write(delegated_credential)
+ self.logger.debug("(Over)wrote %s"%filename)
+ hrn_delegated_credentials.append ((hrn, htype, delegated_credential, filename, ))
+
+ # (f) and finally upload them to manifold server
+ # xxx todo add an option so the password can be set on the command line
+ # (but *NOT* in the config file) so other apps can leverage this
+ self.logger.info("Uploading on backend at %s"%myslice_dict['backend'])
+ uploader = ManifoldUploader (logger=self.logger,
+ url=myslice_dict['backend'],
+ platform=myslice_dict['platform'],
+ username=myslice_dict['username'],
+ password=options.password)
+ uploader.prompt_all()
+ (count_all,count_success)=(0,0)
+ for (hrn,htype,delegated_credential,filename) in hrn_delegated_credentials:
+ # inspect
+ inspect=Credential(string=delegated_credential)
+ expire_datetime=inspect.get_expiration()
+ message="%s (%s) [exp:%s]"%(hrn,htype,expire_datetime)
+ if uploader.upload(delegated_credential,message=message):
+ count_success+=1
+ count_all+=1
+ self.logger.info("Successfully uploaded %d/%d credentials"%(count_success,count_all))
+
+ # at first I thought we would want to save these,
+ # like 'sfi delegate does' but on second thought
+ # it is probably not helpful as people would not
+ # need to run 'sfi delegate' at all anymore
+ if count_success != count_all: sys.exit(1)
+ return
+
+ @register_command("cred","")