# Mark Huang <mlhuang@cs.princeton.edu>
# Copyright (C) 2006 The Trustees of Princeton University
#
-# $Id: Auth.py,v 1.9 2006/12/15 18:35:38 mlhuang Exp $
+# $Id: Auth.py 5574 2007-10-25 20:33:17Z thierry $
#
import crypt
from PLC.Parameter import Parameter, Mixed
from PLC.Persons import Persons
from PLC.Nodes import Node, Nodes
+from PLC.NodeNetworks import NodeNetwork, NodeNetworks
from PLC.Sessions import Session, Sessions
from PLC.Peers import Peer, Peers
+from PLC.Boot import notify_owners
class Auth(Parameter):
"""
Base class for all API authentication methods, as well as a class
- that can be used to represent Mixed(SessionAuth(), PasswordAuth(),
- GPGAuth()), i.e. the three principal API authentication methods.
+ that can be used to represent all supported API authentication
+ methods.
"""
- def __init__(self, auth = {}):
+ def __init__(self, auth = None):
+ if auth is None:
+ auth = {'AuthMethod': Parameter(str, "Authentication method to use", optional = False)}
Parameter.__init__(self, auth, "API authentication structure")
def check(self, method, auth, *args):
- method.type_check("auth", auth,
- Mixed(SessionAuth(), PasswordAuth(), GPGAuth()),
- (auth,) + args)
+ # Method.type_check() should have checked that all of the
+ # mandatory fields were present.
+ assert 'AuthMethod' in auth
+
+ if auth['AuthMethod'] == "session":
+ expected = SessionAuth()
+ elif auth['AuthMethod'] == "password" or \
+ auth['AuthMethod'] == "capability":
+ expected = PasswordAuth()
+ elif auth['AuthMethod'] == "gpg":
+ expected = GPGAuth()
+ elif auth['AuthMethod'] == "hmac":
+ expected = BootAuth()
+ elif auth['AuthMethod'] == "anonymous":
+ expected = AnonymousAuth()
+ else:
+ raise PLCInvalidArgument("must be 'session', 'password', 'gpg', 'hmac', or 'anonymous'", "AuthMethod")
+
+ # Re-check using the specified authentication method
+ method.type_check("auth", auth, expected, (auth,) + args)
class GPGAuth(Auth):
"""
method.caller = peer = peers[0]
keys = [peer['key']]
else:
- persons = Persons(method.api, {'email': auth['name'], 'enabled': True})
+ persons = Persons(method.api, {'email': auth['name'], 'enabled': True, 'peer_id': None})
if not persons:
- raise PLCAuthenticationFailure, "No such peer or user '%s'" % auth['name']
+ raise PLCAuthenticationFailure, "No such user '%s'" % auth['name']
if not set(person['roles']).intersection(method.roles):
raise PLCAuthenticationFailure, "Not allowed to call method"
method.caller = person = persons[0]
- keys = Keys(method.api, {'key_id': person['key_ids'], 'key_type': "gpg"})
+ keys = Keys(method.api, {'key_id': person['key_ids'], 'key_type': "gpg", 'peer_id': None})
if not keys:
raise PLCAuthenticationFailure, "No GPG key on record for peer or user '%s'"
for key in keys:
try:
from PLC.GPG import gpg_verify
- gpg_verify(method.name, args, auth['signature'], key)
+ gpg_verify(args, key, auth['signature'], method.name)
return
except PLCAuthenticationFailure, fault:
pass
try:
if session['node_id'] is not None:
- nodes = Nodes(method.api, [session['node_id']])
+ nodes = Nodes(method.api, {'node_id': session['node_id'], 'peer_id': None})
if not nodes:
raise PLCAuthenticationFailure, "No such node"
node = nodes[0]
method.caller = node
elif session['person_id'] is not None and session['expires'] > time.time():
- persons = Persons(method.api, {'person_id': session['person_id'], 'enabled': True})
+ persons = Persons(method.api, {'person_id': session['person_id'], 'enabled': True, 'peer_id': None})
if not persons:
raise PLCAuthenticationFailure, "No such account"
person = persons[0]
if not set(person['roles']).intersection(method.roles):
- raise PLCAuthenticationFailure, "Not allowed to call method"
+ raise PLCPermissionDenied, "Not allowed to call method"
method.caller = persons[0]
# mandatory fields were present.
assert auth.has_key('node_id')
+ if 'node' not in method.roles:
+ raise PLCAuthenticationFailure, "Not allowed to call method"
+
try:
- nodes = Nodes(method.api, [auth['node_id']])
+ nodes = Nodes(method.api, {'node_id': auth['node_id'], 'peer_id': None})
if not nodes:
raise PLCAuthenticationFailure, "No such node"
node = nodes[0]
raise PLCAuthenticationFailure, "Cannot determine IP address of requestor"
if nodenetwork['ip'] != method.source[0]:
- raise PLCAuthenticationFailure, "Requestor IP %s does not mach node IP %s" % \
+ raise PLCAuthenticationFailure, "Requestor IP %s does not match node IP %s" % \
(method.source[0], nodenetwork['ip'])
else:
raise PLCAuthenticationFailure, "No node key or boot nonce"
method.caller = node
except PLCAuthenticationFailure, fault:
- # XXX Send e-mail
+ if nodes:
+ notify_owners(method, node, 'authfail', include_pis = True, include_techs = True, fault = fault)
raise fault
class AnonymousAuth(Auth):
})
def check(self, method, auth, *args):
- # Sure, dude, whatever
- return True
+ if 'anonymous' not in method.roles:
+ raise PLCAuthenticationFailure, "Not allowed to call method anonymously"
+
+ method.caller = None
class PasswordAuth(Auth):
"""
def __init__(self):
Auth.__init__(self, {
- 'AuthMethod': Parameter(str, "Authentication method to use, typically 'password'", optional = False),
+ 'AuthMethod': Parameter(str, "Authentication method to use, always 'password' or 'capability'", optional = False),
'Username': Parameter(str, "PlanetLab username, typically an e-mail address", optional = False),
'AuthString': Parameter(str, "Authentication string, typically a password", optional = False),
})
assert auth.has_key('Username')
# Get record (must be enabled)
- persons = Persons(method.api, {'email': auth['Username'], 'enabled': True})
+ persons = Persons(method.api, {'email': auth['Username'].lower(), 'enabled': True, 'peer_id': None})
if len(persons) != 1:
raise PLCAuthenticationFailure, "No such account"
raise PLCAuthenticationFailure, "Password verification failed"
if not set(person['roles']).intersection(method.roles):
- raise PLCAuthenticationFailure, "Not allowed to call method"
+ raise PLCAuthenticationFailure, "Not allowed to call method"
method.caller = person