git://git.onelab.eu
/
sfa.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
list of pi in in key PI; SM uses the authority credential while contacting AM for...
[sfa.git]
/
sfa
/
trust
/
auth.py
diff --git
a/sfa/trust/auth.py
b/sfa/trust/auth.py
index
57583e4
..
ebee589
100644
(file)
--- a/
sfa/trust/auth.py
+++ b/
sfa/trust/auth.py
@@
-203,34
+203,21
@@
class Auth:
raise PermissionError(name)
raise PermissionError(name)
- def determine_user_rights(self,
src_cred
, record):
+ def determine_user_rights(self,
caller_hrn
, record):
"""
Given a user credential and a record, determine what set of rights the
user should have to that record.
"""
Given a user credential and a record, determine what set of rights the
user should have to that record.
-
- Src_cred can be None when obtaining a user credential, but should be
- set to a valid user credential when obtaining a slice or authority
- credential.
-
+
This is intended to replace determine_rights() and
verify_cancreate_credential()
"""
This is intended to replace determine_rights() and
verify_cancreate_credential()
"""
- type = record['type']
- if src_cred:
- cred_object_hrn = src_cred.get_gid_object().get_hrn()
- else:
- # supplying src_cred==None is only valid when obtaining user
- # credentials.
- #assert(type == "user")
-
- cred_object_hrn = None
-
rl = RightList()
rl = RightList()
+ type = record['type']
if type=="slice":
researchers = record.get("researcher", [])
if type=="slice":
researchers = record.get("researcher", [])
- if (c
red_object
_hrn in researchers):
+ if (c
aller
_hrn in researchers):
rl.add("refresh")
rl.add("embed")
rl.add("bind")
rl.add("refresh")
rl.add("embed")
rl.add("bind")
@@
-238,11
+225,13
@@
class Auth:
rl.add("info")
elif type == "authority":
rl.add("info")
elif type == "authority":
- pis = record.get("
pi
", [])
+ pis = record.get("
PI
", [])
operators = record.get("operator", [])
operators = record.get("operator", [])
- if (cred_object_hrn in pis):
+ if (caller_hrn == self.config.SFA_INTERFACE_HRN):
+ rl.add("authority,sa,ma",)
+ if (caller_hrn in pis):
rl.add("authority,sa")
rl.add("authority,sa")
- if (c
red_object
_hrn in operators):
+ if (c
aller
_hrn in operators):
rl.add("authority,ma")
elif type == "user":
rl.add("authority,ma")
elif type == "user":