svn keywords

[plcapi.git] / PLC / Auth.py

diff --git a/PLC/Auth.py b/PLC/Auth.py
index f71b634..9fea3e3 100644 (file)
--- a/PLC/Auth.py
+++ b/PLC/Auth.py
@@ -4,7 +4,8 @@
 # Mark Huang <mlhuang@cs.princeton.edu>
 # Copyright (C) 2006 The Trustees of Princeton University
 #
-# $Id: Auth.py,v 1.13 2007/01/30 23:09:55 mlhuang Exp $
+# $Id$
+# $URL$
 #
 
 import crypt
@@ -16,10 +17,28 @@ from PLC.Faults import *
 from PLC.Parameter import Parameter, Mixed
 from PLC.Persons import Persons
 from PLC.Nodes import Node, Nodes
+from PLC.Interfaces import Interface, Interfaces
 from PLC.Sessions import Session, Sessions
 from PLC.Peers import Peer, Peers
 from PLC.Boot import notify_owners
 
+def map_auth(auth):
+    if auth['AuthMethod'] == "session":
+        expected = SessionAuth()
+    elif auth['AuthMethod'] == "password" or \
+         auth['AuthMethod'] == "capability":
+        expected = PasswordAuth()
+    elif auth['AuthMethod'] == "gpg":
+        expected = GPGAuth()
+    elif auth['AuthMethod'] == "hmac" or \
+         auth['AuthMethod'] == "hmac_dummybox":
+        expected = BootAuth()
+    elif auth['AuthMethod'] == "anonymous":
+        expected = AnonymousAuth()
+    else:
+        raise PLCInvalidArgument("must be 'session', 'password', 'gpg', 'hmac', 'hmac_dummybox', or 'anonymous'", "AuthMethod")
+    return expected
+
 class Auth(Parameter):
     """
     Base class for all API authentication methods, as well as a class
@@ -37,19 +56,7 @@ class Auth(Parameter):
         # mandatory fields were present.
         assert 'AuthMethod' in auth
 
-        if auth['AuthMethod'] == "session":
-            expected = SessionAuth()
-        elif auth['AuthMethod'] == "password" or \
-             auth['AuthMethod'] == "capability":
-            expected = PasswordAuth()
-        elif auth['AuthMethod'] == "gpg":
-            expected = GPGAuth()
-        elif auth['AuthMethod'] == "hmac":
-            expected = BootAuth()
-        elif auth['AuthMethod'] == "anonymous":
-            expected = AnonymousAuth()
-        else:
-            raise PLCInvalidArgument("must be 'session', 'password', 'gpg', 'hmac', or 'anonymous'", "AuthMethod")
+        expected = map_auth(auth)
 
         # Re-check using the specified authentication method
         method.type_check("auth", auth, expected, (auth,) + args)
@@ -92,7 +99,7 @@ class GPGAuth(Auth):
             for key in keys:
                 try:
                     from PLC.GPG import gpg_verify
-                    gpg_verify(method.name, args, auth['signature'], key)
+                    gpg_verify(args, key, auth['signature'], method.name)
                     return
                 except PLCAuthenticationFailure, fault:
                     pass
@@ -146,7 +153,7 @@ class SessionAuth(Auth):
                 person = persons[0]
 
                 if not set(person['roles']).intersection(method.roles):
-                    raise PLCAuthenticationFailure, "Not allowed to call method"
+                    raise PLCPermissionDenied, "Not allowed to call method"
 
                 method.caller = persons[0]
 
@@ -223,22 +230,22 @@ class BootAuth(Auth):
                 # on record for the node.
                 key = node['boot_nonce']
 
-                nodenetwork = None
-                if node['nodenetwork_ids']:
-                    nodenetworks = NodeNetworks(method.api, node['nodenetwork_ids'])
-                    for nodenetwork in nodenetworks:
-                        if nodenetwork['is_primary']:
+                interface = None
+                if node['interface_ids']:
+                    interfaces = Interfaces(method.api, node['interface_ids'])
+                    for interface in interfaces:
+                        if interface['is_primary']:
                             break
             
-                if not nodenetwork or not nodenetwork['is_primary']:
+                if not interface or not interface['is_primary']:
                     raise PLCAuthenticationFailure, "No primary network interface on record"
             
                 if method.source is None:
                     raise PLCAuthenticationFailure, "Cannot determine IP address of requestor"
 
-                if nodenetwork['ip'] != method.source[0]:
+                if interface['ip'] != method.source[0]:
                     raise PLCAuthenticationFailure, "Requestor IP %s does not match node IP %s" % \
-                          (method.source[0], nodenetwork['ip'])
+                          (method.source[0], interface['ip'])
             else:
                 raise PLCAuthenticationFailure, "No node key or boot nonce"
 
@@ -295,7 +302,7 @@ class PasswordAuth(Auth):
         assert auth.has_key('Username')
 
         # Get record (must be enabled)
-        persons = Persons(method.api, {'email': auth['Username'], 'enabled': True, 'peer_id': None})
+        persons = Persons(method.api, {'email': auth['Username'].lower(), 'enabled': True, 'peer_id': None})
         if len(persons) != 1:
             raise PLCAuthenticationFailure, "No such account"
 
@@ -326,6 +333,6 @@ class PasswordAuth(Auth):
                 raise PLCAuthenticationFailure, "Password verification failed"
 
         if not set(person['roles']).intersection(method.roles):
-            raise PLCAuthenticationFailure, "Not allowed to call method"
+           raise PLCAuthenticationFailure, "Not allowed to call method"
 
         method.caller = person