# Mark Huang <mlhuang@cs.princeton.edu>
# Copyright (C) 2006 The Trustees of Princeton University
#
-# $Id: Auth.py,v 1.3 2006/09/25 14:47:32 mlhuang Exp $
+# $Id: Auth.py,v 1.10 2007/01/04 16:01:28 mlhuang Exp $
#
import crypt
import sha
import hmac
+import time
from PLC.Faults import *
from PLC.Parameter import Parameter, Mixed
from PLC.Persons import Persons
from PLC.Nodes import Node, Nodes
+from PLC.Sessions import Session, Sessions
+from PLC.Peers import Peer, Peers
-class Auth(Parameter, dict):
+class Auth(Parameter):
"""
- Base class for all API authentication methods.
+ Base class for all API authentication methods, as well as a class
+ that can be used to represent Mixed(SessionAuth(), PasswordAuth(),
+ GPGAuth()), i.e. the three principal API authentication methods.
"""
- def __init__(self, auth):
+ def __init__(self, auth = {}):
Parameter.__init__(self, auth, "API authentication structure")
- dict.__init__(auth)
+
+ def check(self, method, auth, *args):
+ method.type_check("auth", auth,
+ Mixed(SessionAuth(), PasswordAuth(), GPGAuth()),
+ (auth,) + args)
+
+class GPGAuth(Auth):
+ """
+ Proposed PlanetLab federation authentication structure.
+ """
+
+ def __init__(self):
+ Auth.__init__(self, {
+ 'AuthMethod': Parameter(str, "Authentication method to use, always 'gpg'", optional = False),
+ 'name': Parameter(str, "Peer or user name", optional = False),
+ 'signature': Parameter(str, "Message signature", optional = False)
+ })
+
+ def check(self, method, auth, *args):
+ try:
+ peers = Peers(method.api, [auth['name']])
+ if peers:
+ if 'peer' not in method.roles:
+ raise PLCAuthenticationFailure, "Not allowed to call method"
+
+ method.caller = peer = peers[0]
+ keys = [peer['key']]
+ else:
+ persons = Persons(method.api, {'email': auth['name'], 'enabled': True, 'peer_id': None})
+ if not persons:
+ raise PLCAuthenticationFailure, "No such user '%s'" % auth['name']
+
+ if not set(person['roles']).intersection(method.roles):
+ raise PLCAuthenticationFailure, "Not allowed to call method"
+
+ method.caller = person = persons[0]
+ keys = Keys(method.api, {'key_id': person['key_ids'], 'key_type': "gpg", 'peer_id': None})
+
+ if not keys:
+ raise PLCAuthenticationFailure, "No GPG key on record for peer or user '%s'"
+
+ for key in keys:
+ try:
+ from PLC.GPG import gpg_verify
+ gpg_verify(method.name, args, auth['signature'], key)
+ return
+ except PLCAuthenticationFailure, fault:
+ pass
+
+ raise fault
+
+ except PLCAuthenticationFailure, fault:
+ # XXX Send e-mail
+ raise fault
+
+class SessionAuth(Auth):
+ """
+ Secondary authentication method. After authenticating with a
+ primary authentication method, call GetSession() to generate a
+ session key that may be used for subsequent calls.
+ """
+
+ def __init__(self):
+ Auth.__init__(self, {
+ 'AuthMethod': Parameter(str, "Authentication method to use, always 'session'", optional = False),
+ 'session': Parameter(str, "Session key", optional = False)
+ })
+
+ def check(self, method, auth, *args):
+ # Method.type_check() should have checked that all of the
+ # mandatory fields were present.
+ assert auth.has_key('session')
+
+ # Get session record
+ sessions = Sessions(method.api, [auth['session']], expires = None)
+ if not sessions:
+ raise PLCAuthenticationFailure, "No such session"
+ session = sessions[0]
+
+ try:
+ if session['node_id'] is not None:
+ nodes = Nodes(method.api, {'node_id': session['node_id'], 'peer_id': None})
+ if not nodes:
+ raise PLCAuthenticationFailure, "No such node"
+ node = nodes[0]
+
+ if 'node' not in method.roles:
+ raise PLCAuthenticationFailure, "Not allowed to call method"
+
+ method.caller = node
+
+ elif session['person_id'] is not None and session['expires'] > time.time():
+ persons = Persons(method.api, {'person_id': session['person_id'], 'enabled': True, 'peer_id': None})
+ if not persons:
+ raise PLCAuthenticationFailure, "No such account"
+ person = persons[0]
+
+ if not set(person['roles']).intersection(method.roles):
+ raise PLCAuthenticationFailure, "Not allowed to call method"
+
+ method.caller = persons[0]
+
+ else:
+ raise PLCAuthenticationFailure, "Invalid session"
+
+ except PLCAuthenticationFailure, fault:
+ session.delete()
+ raise fault
class BootAuth(Auth):
"""
assert auth.has_key('node_id')
try:
- nodes = Nodes(method.api, [auth['node_id']]).values()
+ nodes = Nodes(method.api, {'node_id': auth['node_id'], 'peer_id': None})
if not nodes:
raise PLCAuthenticationFailure, "No such node"
node = nodes[0]
nodenetwork = None
if node['nodenetwork_ids']:
- nodenetworks = NodeNetworks(method.api, node['nodenetwork_ids']).values()
+ nodenetworks = NodeNetworks(method.api, node['nodenetwork_ids'])
for nodenetwork in nodenetworks:
if nodenetwork['is_primary']:
break
assert auth.has_key('Username')
# Get record (must be enabled)
- persons = Persons(method.api, [auth['Username']], enabled = True)
+ persons = Persons(method.api, {'email': auth['Username'], 'enabled': True, 'peer_id': None})
if len(persons) != 1:
raise PLCAuthenticationFailure, "No such account"
- person = persons.values()[0]
+ person = persons[0]
if auth['Username'] == method.api.config.PLC_API_MAINTENANCE_USER:
# "Capability" authentication, whatever the hell that was
git://git.onelab.eu / plcapi.git / blobdiff