Merge branch 'master' into senslab2

[sfa.git] / sfa / trust / credential.py

diff --git a/sfa/trust/credential.py b/sfa/trust/credential.py
index 7f34757..09835d9 100644 (file)
--- a/sfa/trust/credential.py
+++ b/sfa/trust/credential.py
@@ -51,7 +51,7 @@ from sfa.trust.gid import GID
 from sfa.util.xrn import urn_to_hrn, hrn_authfor_hrn
 
 # 2 weeks, in seconds 
-DEFAULT_CREDENTIAL_LIFETIME = 86400 * 14
+DEFAULT_CREDENTIAL_LIFETIME = 86400 * 31
 
 
 # TODO:
@@ -160,10 +160,8 @@ class Signature(object):
 
 
     def get_refid(self):
-        #print>>sys.stderr," \r\n \r\n credential.py Signature get_refid\ self.refid %s " %(self.refid)
         if not self.refid:
             self.decode()
-            #print>>sys.stderr," \r\n \r\n credential.py Signature get_refid self.refid %s " %(self.refid)
         return self.refid
 
     def get_xml(self):
@@ -280,6 +278,7 @@ class Credential(object):
             self.decode()
         return self.gidObject.get_printable_subject()
 
+    # sounds like this should be __repr__ instead ??
     def get_summary_tostring(self):
         if not self.gidObject:
             self.decode()
@@ -591,7 +590,6 @@ class Credential(object):
     def updateRefID(self):
         if not self.parent:
             self.set_refid('ref0') 
-            #print>>sys.stderr, " \r\n \r\n updateRefID next_cred ref0 "
             return []
         
         refs = []
@@ -603,10 +601,8 @@ class Credential(object):
             refs.append(next_cred.get_refid())
             if next_cred.parent:
                 next_cred = next_cred.parent
-                #print>>sys.stderr, " \r\n \r\n updateRefID next_cred "
             else:
                 next_cred = None
-                #print>>sys.stderr, " \r\n \r\n updateRefID next_cred NONE"
 
         
         # Find a unique refid for this credential
@@ -811,12 +807,10 @@ class Credential(object):
                     # Failures here include unreadable files
                     # or non PEM files
                     trusted_cert_objects.append(GID(filename=f))
-                    #print>>sys.stderr, " \r\n \t\t\t credential.py verify trusted_certs %s" %(GID(filename=f).get_hrn())
                     ok_trusted_certs.append(f)
                 except Exception, exc:
                     logger.error("Failed to load trusted cert from %s: %r", f, exc)
             trusted_certs = ok_trusted_certs
-            #print>>sys.stderr, " \r\n \t\t\t credential.py verify trusted_certs elemnebts %s" %(len(trusted_certs))
 
         # Use legacy verification if this is a legacy credential
         if self.legacy:
@@ -843,7 +837,6 @@ class Credential(object):
             for cur_cred in self.get_credential_list():
                 cur_cred.get_gid_object().verify_chain(trusted_cert_objects)
                 cur_cred.get_gid_caller().verify_chain(trusted_cert_objects)        
-                #print>>sys.stderr, " \r\n \t\t\t credential.py verify cur_cred get_gid_object hrn %s get_gid_caller %s" %(cur_cred.get_gid_object().get_hrn(),cur_cred.get_gid_caller().get_hrn()) 
 
         refs = []
         refs.append("Sig_%s" % self.get_refid())
@@ -851,7 +844,6 @@ class Credential(object):
         parentRefs = self.updateRefID()
         for ref in parentRefs:
             refs.append("Sig_%s" % ref)
-            #print>>sys.stderr, " \r\n \t\t\t credential.py verify trusted_certs refs",  ref 
         for ref in refs:
             # If caller explicitly passed in None that means skip xmlsec1 validation.
             # Strange and not typical
@@ -862,7 +854,6 @@ class Credential(object):
 #                (self.xmlsec_path, ref, cert_args, filename)
             verified = os.popen('%s --verify --node-id "%s" %s %s 2>&1' \
                             % (self.xmlsec_path, ref, cert_args, filename)).read()
-            #print>>sys.stderr, " \r\n \t\t\t credential.py verify filename %s verified %s " %(filename,verified)             
             if not verified.strip().startswith("OK"):
                 # xmlsec errors have a msg= which is the interesting bit.
                 mstart = verified.find("msg=")
@@ -874,11 +865,9 @@ class Credential(object):
                 raise CredentialNotVerifiable("xmlsec1 error verifying cred %s using Signature ID %s: %s %s" % (self.get_summary_tostring(), ref, msg, verified.strip()))
         os.remove(filename)
         
-        #print>>sys.stderr, " \r\n \t\t\t credential.py HUMMM parents %s", self.parent
         # Verify the parents (delegation)
         if self.parent:
             self.verify_parent(self.parent)
-        #print>>sys.stderr, " \r\n \t\t\t credential.py verify trusted_certs parents" 
         # Make sure the issuer is the target's authority, and is
         # itself a valid GID
         self.verify_issuer(trusted_cert_objects)
@@ -981,7 +970,6 @@ class Credential(object):
     # . The expiry time on the child must be no later than the parent
     # . The signer of the child must be the owner of the parent        
     def verify_parent(self, parent_cred):
-        #print>>sys.stderr, " \r\n\r\n \t verify_parent parent_cred.get_gid_caller().save_to_string(False) %s  self.get_signature().get_issuer_gid().save_to_string(False) %s" %(parent_cred.get_gid_caller().get_hrn(),self.get_signature().get_issuer_gid().get_hrn())
         # make sure the rights given to the child are a subset of the
         # parents rights (and check delegate bits)
         if not parent_cred.get_privileges().is_superset(self.get_privileges()):