X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=PLC%2FAuth.py;h=bb62c0919bad7a27758a7c4858636e49e7843eda;hb=929d1cbbc300f8a33cf0cfe9d6add3b898e0c552;hp=ee1c418f1859a7b591cc0f71ce5a1f163d835bb2;hpb=85b7f2b1a7665e3f6926d1be2f4fc2f70f0ff216;p=plcapi.git diff --git a/PLC/Auth.py b/PLC/Auth.py index ee1c418..bb62c09 100644 --- a/PLC/Auth.py +++ b/PLC/Auth.py @@ -4,42 +4,95 @@ # Mark Huang # Copyright (C) 2006 The Trustees of Princeton University # -# $Id: Auth.py,v 1.4 2006/10/25 14:22:14 mlhuang Exp $ +# $Id: Auth.py,v 1.10 2007/01/04 16:01:28 mlhuang Exp $ # import crypt import sha import hmac +import time from PLC.Faults import * from PLC.Parameter import Parameter, Mixed from PLC.Persons import Persons from PLC.Nodes import Node, Nodes from PLC.Sessions import Session, Sessions +from PLC.Peers import Peer, Peers -class Auth(Parameter, dict): +class Auth(Parameter): """ Base class for all API authentication methods, as well as a class - that can be used to represent Mixed(SessionAuth(), PasswordAuth()), - i.e. the two principal API authentication methods. + that can be used to represent Mixed(SessionAuth(), PasswordAuth(), + GPGAuth()), i.e. the three principal API authentication methods. """ def __init__(self, auth = {}): Parameter.__init__(self, auth, "API authentication structure") - dict.__init__(auth) def check(self, method, auth, *args): method.type_check("auth", auth, - Mixed(SessionAuth(), PasswordAuth()), + Mixed(SessionAuth(), PasswordAuth(), GPGAuth()), (auth,) + args) -class SessionAuth(Auth): +class GPGAuth(Auth): """ Proposed PlanetLab federation authentication structure. """ def __init__(self): Auth.__init__(self, { + 'AuthMethod': Parameter(str, "Authentication method to use, always 'gpg'", optional = False), + 'name': Parameter(str, "Peer or user name", optional = False), + 'signature': Parameter(str, "Message signature", optional = False) + }) + + def check(self, method, auth, *args): + try: + peers = Peers(method.api, [auth['name']]) + if peers: + if 'peer' not in method.roles: + raise PLCAuthenticationFailure, "Not allowed to call method" + + method.caller = peer = peers[0] + keys = [peer['key']] + else: + persons = Persons(method.api, {'email': auth['name'], 'enabled': True, 'peer_id': None}) + if not persons: + raise PLCAuthenticationFailure, "No such user '%s'" % auth['name'] + + if not set(person['roles']).intersection(method.roles): + raise PLCAuthenticationFailure, "Not allowed to call method" + + method.caller = person = persons[0] + keys = Keys(method.api, {'key_id': person['key_ids'], 'key_type': "gpg", 'peer_id': None}) + + if not keys: + raise PLCAuthenticationFailure, "No GPG key on record for peer or user '%s'" + + for key in keys: + try: + from PLC.GPG import gpg_verify + gpg_verify(method.name, args, auth['signature'], key) + return + except PLCAuthenticationFailure, fault: + pass + + raise fault + + except PLCAuthenticationFailure, fault: + # XXX Send e-mail + raise fault + +class SessionAuth(Auth): + """ + Secondary authentication method. After authenticating with a + primary authentication method, call GetSession() to generate a + session key that may be used for subsequent calls. + """ + + def __init__(self): + Auth.__init__(self, { + 'AuthMethod': Parameter(str, "Authentication method to use, always 'session'", optional = False), 'session': Parameter(str, "Session key", optional = False) }) @@ -49,14 +102,14 @@ class SessionAuth(Auth): assert auth.has_key('session') # Get session record - sessions = Sessions(method.api, [auth['session']]).values() + sessions = Sessions(method.api, [auth['session']], expires = None) if not sessions: raise PLCAuthenticationFailure, "No such session" session = sessions[0] try: if session['node_id'] is not None: - nodes = Nodes(method.api, [session['node_id']]).values() + nodes = Nodes(method.api, {'node_id': session['node_id'], 'peer_id': None}) if not nodes: raise PLCAuthenticationFailure, "No such node" node = nodes[0] @@ -66,8 +119,8 @@ class SessionAuth(Auth): method.caller = node - elif session['person_id'] is not None: - persons = Persons(method.api, [session['person_id']], enabled = True).values() + elif session['person_id'] is not None and session['expires'] > time.time(): + persons = Persons(method.api, {'person_id': session['person_id'], 'enabled': True, 'peer_id': None}) if not persons: raise PLCAuthenticationFailure, "No such account" person = persons[0] @@ -129,7 +182,7 @@ class BootAuth(Auth): assert auth.has_key('node_id') try: - nodes = Nodes(method.api, [auth['node_id']]).values() + nodes = Nodes(method.api, {'node_id': auth['node_id'], 'peer_id': None}) if not nodes: raise PLCAuthenticationFailure, "No such node" node = nodes[0] @@ -149,7 +202,7 @@ class BootAuth(Auth): nodenetwork = None if node['nodenetwork_ids']: - nodenetworks = NodeNetworks(method.api, node['nodenetwork_ids']).values() + nodenetworks = NodeNetworks(method.api, node['nodenetwork_ids']) for nodenetwork in nodenetworks: if nodenetwork['is_primary']: break @@ -216,11 +269,11 @@ class PasswordAuth(Auth): assert auth.has_key('Username') # Get record (must be enabled) - persons = Persons(method.api, [auth['Username']], enabled = True) + persons = Persons(method.api, {'email': auth['Username'], 'enabled': True, 'peer_id': None}) if len(persons) != 1: raise PLCAuthenticationFailure, "No such account" - person = persons.values()[0] + person = persons[0] if auth['Username'] == method.api.config.PLC_API_MAINTENANCE_USER: # "Capability" authentication, whatever the hell that was