from PLC.Interfaces import Interface, Interfaces
from PLC.Sessions import Session, Sessions
from PLC.Peers import Peer, Peers
+from PLC.Keys import Keys
from PLC.Boot import notify_owners
class Auth(Parameter):
if auth['AuthMethod'] in auth_methods:
expected = auth_methods[auth['AuthMethod']]()
else:
- sm = "'" + "', '".join(auth_methods.keys()) + "'"
+ sm = "'" + "', '".join(list(auth_methods.keys())) + "'"
raise PLCInvalidArgument("must be " + sm, "AuthMethod")
# Re-check using the specified authentication method
peers = Peers(method.api, [auth['name']])
if peers:
if 'peer' not in method.roles:
- raise PLCAuthenticationFailure, "GPGAuth: Not allowed to call method, missing 'peer' role"
+ raise PLCAuthenticationFailure("GPGAuth: Not allowed to call method, missing 'peer' role")
method.caller = peer = peers[0]
- keys = [peer['key']]
+ gpg_keys = [ peer['key'] ]
else:
persons = Persons(method.api, {'email': auth['name'], 'enabled': True, 'peer_id': None})
if not persons:
- raise PLCAuthenticationFailure, "GPGAuth: No such user '%s'" % auth['name']
+ raise PLCAuthenticationFailure("GPGAuth: No such user '%s'" % auth['name'])
+ method.caller = person = persons[0]
if not set(person['roles']).intersection(method.roles):
- raise PLCAuthenticationFailure, "GPGAuth: Not allowed to call method, missing role"
+ raise PLCAuthenticationFailure("GPGAuth: Not allowed to call method, missing role")
- method.caller = person = persons[0]
keys = Keys(method.api, {'key_id': person['key_ids'], 'key_type': "gpg", 'peer_id': None})
+ gpg_keys = [ key['key'] for key in keys ]
- if not keys:
- raise PLCAuthenticationFailure, "GPGAuth: No GPG key on record for peer or user '%s'"
+ if not gpg_keys:
+ raise PLCAuthenticationFailure("GPGAuth: No GPG key on record for peer or user '%s'"%auth['name'])
- for key in keys:
+ for gpg_key in gpg_keys:
try:
from PLC.GPG import gpg_verify
- gpg_verify(args, key, auth['signature'], method.name)
+ gpg_verify(args, gpg_key, auth['signature'], method.name)
return
- except PLCAuthenticationFailure, fault:
+ except PLCAuthenticationFailure as fault:
pass
raise fault
- except PLCAuthenticationFailure, fault:
+ except PLCAuthenticationFailure as fault:
# XXX Send e-mail
raise fault
def check(self, method, auth, *args):
# Method.type_check() should have checked that all of the
# mandatory fields were present.
- assert auth.has_key('session')
+ assert 'session' in auth
# Get session record
sessions = Sessions(method.api, [auth['session']], expires = None)
if not sessions:
- raise PLCAuthenticationFailure, "SessionAuth: No such session"
+ raise PLCAuthenticationFailure("SessionAuth: No such session")
session = sessions[0]
try:
if session['node_id'] is not None:
nodes = Nodes(method.api, {'node_id': session['node_id'], 'peer_id': None})
if not nodes:
- raise PLCAuthenticationFailure, "SessionAuth: No such node"
+ raise PLCAuthenticationFailure("SessionAuth: No such node")
node = nodes[0]
if 'node' not in method.roles:
# using PermissionDenied rather than AuthenticationFailure here because
# if that fails we don't want to delete the session..
- raise PLCPermissionDenied, "SessionAuth: Not allowed to call method %s, missing 'node' role"%method.name
- raise PLCAuthenticationFailure, "SessionAuth: Not allowed to call method %s, missing 'node' role"%method.name
+ raise PLCPermissionDenied("SessionAuth: Not allowed to call method %s, missing 'node' role"%method.name)
method.caller = node
elif session['person_id'] is not None and session['expires'] > time.time():
persons = Persons(method.api, {'person_id': session['person_id'], 'enabled': True, 'peer_id': None})
if not persons:
- raise PLCAuthenticationFailure, "SessionAuth: No such enabled account"
+ raise PLCAuthenticationFailure("SessionAuth: No such enabled account")
person = persons[0]
if not set(person['roles']).intersection(method.roles):
method_message="method %s has roles [%s]"%(method.name,','.join(method.roles))
person_message="caller %s has roles [%s]"%(person['email'],','.join(person['roles']))
# not PLCAuthenticationFailure b/c that would end the session..
- raise PLCPermissionDenied, "SessionAuth: missing role, %s -- %s"%(method_message,person_message)
+ raise PLCPermissionDenied("SessionAuth: missing role, %s -- %s"%(method_message,person_message))
method.caller = person
else:
- raise PLCAuthenticationFailure, "SessionAuth: Invalid session"
+ raise PLCAuthenticationFailure("SessionAuth: Invalid session")
- except PLCAuthenticationFailure, fault:
+ except PLCAuthenticationFailure as fault:
session.delete()
raise fault
# Yes, the comments in the old implementation are
# misleading. Keys of dicts are not included in the
# hash.
- values += self.canonicalize(arg.values())
+ values += self.canonicalize(list(arg.values()))
else:
# We use unicode() instead of str().
- values.append(unicode(arg))
+ values.append(str(arg))
return values
def check(self, method, auth, *args):
# Method.type_check() should have checked that all of the
# mandatory fields were present.
- assert auth.has_key('node_id')
+ assert 'node_id' in auth
if 'node' not in method.roles:
- raise PLCAuthenticationFailure, "BootAuth: Not allowed to call method, missing 'node' role"
+ raise PLCAuthenticationFailure("BootAuth: Not allowed to call method, missing 'node' role")
try:
nodes = Nodes(method.api, {'node_id': auth['node_id'], 'peer_id': None})
if not nodes:
- raise PLCAuthenticationFailure, "BootAuth: No such node"
+ raise PLCAuthenticationFailure("BootAuth: No such node")
node = nodes[0]
# Jan 2011 : removing support for old boot CDs
if node['key']:
key = node['key']
else:
- write_debug_line("BootAuth.check: could not get key")
- raise PLCAuthenticationFailure, "BootAuth: No node key"
+ raise PLCAuthenticationFailure("BootAuth: No node key")
# Yes, this is the "canonicalization" method used.
args = self.canonicalize(args)
digest = hmac.new(str(key), msg.encode('utf-8'), sha).hexdigest()
if digest != auth['value']:
- raise PLCAuthenticationFailure, "BootAuth: Call could not be authenticated"
+ raise PLCAuthenticationFailure("BootAuth: Call could not be authenticated")
method.caller = node
- except PLCAuthenticationFailure, fault:
+ except PLCAuthenticationFailure as fault:
if nodes:
notify_owners(method, node, 'authfail', include_pis = True, include_techs = True, fault = fault)
raise fault
def check(self, method, auth, *args):
if 'anonymous' not in method.roles:
- raise PLCAuthenticationFailure, "AnonymousAuth: method cannot be called anonymously"
+ raise PLCAuthenticationFailure("AnonymousAuth: method cannot be called anonymously")
method.caller = None
def check(self, method, auth, *args):
# Method.type_check() should have checked that all of the
# mandatory fields were present.
- assert auth.has_key('Username')
+ assert 'Username' in auth
# Get record (must be enabled)
persons = Persons(method.api, {'email': auth['Username'].lower(), 'enabled': True, 'peer_id': None})
if len(persons) != 1:
- raise PLCAuthenticationFailure, "PasswordAuth: No such account"
+ raise PLCAuthenticationFailure("PasswordAuth: No such account")
person = persons[0]
# only be used on particular machines (those in a list).
sources = method.api.config.PLC_API_MAINTENANCE_SOURCES.split()
if method.source is not None and method.source[0] not in sources:
- raise PLCAuthenticationFailure, "PasswordAuth: Not allowed to login to maintenance account"
+ raise PLCAuthenticationFailure("PasswordAuth: Not allowed to login to maintenance account")
# Not sure why this is not stored in the DB
password = method.api.config.PLC_API_MAINTENANCE_PASSWORD
if auth['AuthString'] != password:
- raise PLCAuthenticationFailure, "PasswordAuth: Maintenance account password verification failed"
+ raise PLCAuthenticationFailure("PasswordAuth: Maintenance account password verification failed")
else:
# Compare encrypted plaintext against encrypted password stored in the DB
plaintext = auth['AuthString'].encode(method.api.encoding)
# Protect against blank passwords in the DB
if password is None or password[:12] == "" or \
crypt.crypt(plaintext, password[:12]) != password:
- raise PLCAuthenticationFailure, "PasswordAuth: Password verification failed"
+ raise PLCAuthenticationFailure("PasswordAuth: Password verification failed")
if not set(person['roles']).intersection(method.roles):
method_message="method %s has roles [%s]"%(method.name,','.join(method.roles))
person_message="caller %s has roles [%s]"%(person['email'],','.join(person['roles']))
- raise PLCAuthenticationFailure, "PasswordAuth: missing role, %s -- %s"%(method_message,person_message)
+ raise PLCAuthenticationFailure("PasswordAuth: missing role, %s -- %s"%(method_message,person_message))
method.caller = person
path = os.path.dirname(__file__) + "/Auth.d"
try:
extensions = os.listdir(path)
-except OSError, e:
+except OSError as e:
extensions = []
for extension in extensions:
if extension.startswith("."):
continue
if not extension.endswith(".py"):
continue
- execfile("%s/%s" % (path, extension))
+ exec(compile(open("%s/%s" % (path, extension)).read(), "%s/%s" % (path, extension), 'exec'))
del extensions
git://git.onelab.eu / plcapi.git / blobdiff