#
-# GeniAPI authentication
+# SfaAPI authentication
#
### $Id$
### $URL$
from sfa.util.faults import *
from sfa.trust.hierarchy import Hierarchy
from sfa.util.config import *
-from sfa.util.misc import *
+from sfa.util.namespace import *
from sfa.trust.gid import GID
+from sfa.util.sfaticket import *
class Auth:
"""
self.client_gid.verify_chain(self.trusted_cert_list)
if self.object_gid:
self.object_gid.verify_chain(self.trusted_cert_list)
+ else:
+ raise MissingTrustedRoots(self.config.get_trustedroots_dir())
return True
+ def check_ticket(self, ticket):
+ """
+ Check if the tickt was signed by a trusted cert
+ """
+ if self.trusted_cert_list:
+ client_ticket = SfaTicket(string=ticket)
+ client_ticket.verify_chain(self.trusted_cert_list)
+ else:
+ raise MissingTrustedRoots(self.config.get_trustedroots_dir())
+
+ return True
+
def verifyPeerCert(self, cert, gid):
# make sure the client_gid matches client's certificate
if not cert:
caller_gid = cred.get_gid_caller()
caller_hrn = caller_gid.get_hrn()
if caller_hrn != self.config.SFA_INTERFACE_HRN:
- raise GeniPermissionError(self.config.SFA_INTEFACE_HRN)
+ raise SfaPermissionDenied(self.config.SFA_INTEFACE_HRN)
return
if type=="slice":
researchers = record.get("researcher", [])
- if (caller_hrn in researchers):
+ pis = record.get("PI", [])
+ if (caller_hrn in researchers + pis):
rl.add("refresh")
rl.add("embed")
rl.add("bind")
rl.add("resolve")
rl.add("info")
- elif type == "component":
- r1.add("operator")
+ elif type == "node":
+ rl.add("operator")
return rl