X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=sfa%2Ftrust%2Fauth.py;h=0b76d9ee65f9c5652e0c7af837dd3d586e793e72;hb=06b330f0ee047bdb107e43e82b1d7356c876bc15;hp=298d0329038932658182eb0aa5867daf99f62faa;hpb=d9a95db9a2f6172e026acb20f440e0a02363143a;p=sfa.git diff --git a/sfa/trust/auth.py b/sfa/trust/auth.py index 298d0329..0b76d9ee 100644 --- a/sfa/trust/auth.py +++ b/sfa/trust/auth.py @@ -1,20 +1,18 @@ # -# GeniAPI authentication +# SfaAPI authentication # -### $Id$ -### $URL$ -# - -import time +import sys +from sfa.trust.certificate import Keypair, Certificate from sfa.trust.credential import Credential from sfa.trust.trustedroot import TrustedRootList -from sfa.trust.rights import RightList from sfa.util.faults import * from sfa.trust.hierarchy import Hierarchy -from sfa.util.genitable import GeniTable from sfa.util.config import * -from sfa.util.misc import * +from sfa.util.xrn import get_authority +from sfa.util.sfaticket import * + +from sfa.util.sfalogging import sfa_logger class Auth: """ @@ -24,17 +22,43 @@ class Auth: def __init__(self, peer_cert = None, config = None ): self.peer_cert = peer_cert self.hierarchy = Hierarchy() - self.trusted_cert_list = TrustedRootList().get_list() if not config: - self.config = Config() - + self.config = Config() + self.load_trusted_certs() - def check(self, cred, operation): + def load_trusted_certs(self): + self.trusted_cert_list = TrustedRootList(self.config.get_trustedroots_dir()).get_list() + self.trusted_cert_file_list = TrustedRootList(self.config.get_trustedroots_dir()).get_file_list() + + + + def checkCredentials(self, creds, operation, hrn = None): + valid = [] + if not isinstance(creds, list): + creds = [creds] + sfa_logger().debug("Auth.checkCredentials with %d creds"%len(creds)) + for cred in creds: + try: + self.check(cred, operation, hrn) + valid.append(cred) + except: + cred_obj=Credential(string=cred) + sfa_logger().debug("failed to validate credential - dump="+cred_obj.dump_string(dump_parents=True)) + error = sys.exc_info()[:2] + continue + + if not len(valid): + raise InsufficientRights('Access denied: %s -- %s' % (error[0],error[1])) + + return valid + + + def check(self, cred, operation, hrn = None): """ Check the credential against the peer cert (callerGID included in the credential matches the caller that is connected to the HTTPS connection, check if the credential was signed by a - trusted cert and check if the credential is allowd to perform + trusted cert and check if the credential is allowed to perform the specified operation. """ self.client_cred = Credential(string = cred) @@ -44,11 +68,10 @@ class Auth: # make sure the client_gid is not blank if not self.client_gid: raise MissingCallerGID(self.client_cred.get_subject()) - - # make sure the client_gid matches client's certificate - peer_cert = self.peer_cert - if not peer_cert.is_pubkey(self.client_gid.get_pubkey()): - raise ConnectionKeyGIDMismatch(self.client_gid.get_subject()) + + # validate the client cert if it exists + if self.peer_cert: + self.verifyPeerCert(self.peer_cert, self.client_gid) # make sure the client is allowed to perform the operation if operation: @@ -56,14 +79,91 @@ class Auth: raise InsufficientRights(operation) if self.trusted_cert_list: - self.client_cred.verify_chain(self.trusted_cert_list) - if self.client_gid: - self.client_gid.verify_chain(self.trusted_cert_list) - if self.object_gid: - self.object_gid.verify_chain(self.trusted_cert_list) - + self.client_cred.verify(self.trusted_cert_file_list) + else: + raise MissingTrustedRoots(self.config.get_trustedroots_dir()) + + # Make sure the credential's target matches the specified hrn. + # This check does not apply to trusted peers + trusted_peers = [gid.get_hrn() for gid in self.trusted_cert_list] + if hrn and self.client_gid.get_hrn() not in trusted_peers: + target_hrn = self.object_gid.get_hrn() + if not hrn == target_hrn: + raise PermissionError("Target hrn: %s doesn't match specified hrn: %s " % \ + (target_hrn, hrn) ) return True + def check_ticket(self, ticket): + """ + Check if the tickt was signed by a trusted cert + """ + if self.trusted_cert_list: + client_ticket = SfaTicket(string=ticket) + client_ticket.verify_chain(self.trusted_cert_list) + else: + raise MissingTrustedRoots(self.config.get_trustedroots_dir()) + + return True + + def verifyPeerCert(self, cert, gid): + # make sure the client_gid matches client's certificate + if not cert.is_pubkey(gid.get_pubkey()): + raise ConnectionKeyGIDMismatch(gid.get_subject()+":"+cert.get_subject()) + + def verifyGidRequestHash(self, gid, hash, arglist): + key = gid.get_pubkey() + if not key.verify_string(str(arglist), hash): + raise BadRequestHash(hash) + + def verifyCredRequestHash(self, cred, hash, arglist): + gid = cred.get_gid_caller() + self.verifyGidRequestHash(gid, hash, arglist) + + def validateGid(self, gid): + if self.trusted_cert_list: + gid.verify_chain(self.trusted_cert_list) + + def validateCred(self, cred): + if self.trusted_cert_list: + cred.verify(self.trusted_cert_file_list) + + def authenticateGid(self, gidStr, argList, requestHash=None): + gid = GID(string = gidStr) + self.validateGid(gid) + # request_hash is optional + if requestHash: + self.verifyGidRequestHash(gid, requestHash, argList) + return gid + + def authenticateCred(self, credStr, argList, requestHash=None): + cred = Credential(string = credStr) + self.validateCred(cred) + # request hash is optional + if requestHash: + self.verifyCredRequestHash(cred, requestHash, argList) + return cred + + def authenticateCert(self, certStr, requestHash): + cert = Certificate(string=certStr) + self.validateCert(self, cert) + + def gidNoop(self, gidStr, value, requestHash): + self.authenticateGid(gidStr, [gidStr, value], requestHash) + return value + + def credNoop(self, credStr, value, requestHash): + self.authenticateCred(credStr, [credStr, value], requestHash) + return value + + def verify_cred_is_me(self, credential): + is_me = False + cred = Credential(string=credential) + caller_gid = cred.get_gid_caller() + caller_hrn = caller_gid.get_hrn() + if caller_hrn != self.config.SFA_INTERFACE_HRN: + raise SfaPermissionDenied(self.config.SFA_INTEFACE_HRN) + + return def get_auth_info(self, auth_hrn): """ @@ -86,6 +186,7 @@ class Auth: @param auth_name human readable name of authority """ + # get auth info will throw an exception if the authority doesnt exist self.get_auth_info(name) @@ -98,9 +199,9 @@ class Auth: @param name human readable name of object """ auth_name = self.get_authority(name) - if not auth_name or name == self.config.SFA_INTERFACE_HRN: - # the root authority belongs to the registry by default? - # TODO: is this true? + if not auth_name: + auth_name = name + if name == self.config.SFA_INTERFACE_HRN: return self.verify_auth_belongs_to_me(auth_name) @@ -128,34 +229,23 @@ class Auth: raise PermissionError(name) - def determine_user_rights(self, src_cred, record): + def determine_user_rights(self, caller_hrn, record): """ Given a user credential and a record, determine what set of rights the user should have to that record. - - Src_cred can be None when obtaining a user credential, but should be - set to a valid user credential when obtaining a slice or authority - credential. - + This is intended to replace determine_rights() and verify_cancreate_credential() """ + rl = Rights() type = record['type'] - if src_cred: - cred_object_hrn = src_cred.get_gid_object().get_hrn() - else: - # supplying src_cred==None is only valid when obtaining user - # credentials. - #assert(type == "user") - - cred_object_hrn = None - rl = RightList() if type=="slice": researchers = record.get("researcher", []) - if (cred_object_hrn in researchers): + pis = record.get("PI", []) + if (caller_hrn in researchers + pis): rl.add("refresh") rl.add("embed") rl.add("bind") @@ -163,12 +253,17 @@ class Auth: rl.add("info") elif type == "authority": - pis = record.get("pi", []) + pis = record.get("PI", []) operators = record.get("operator", []) - rl.add("authority,sa,ma") - if (cred_object_hrn in pis): + if (caller_hrn == self.config.SFA_INTERFACE_HRN): + rl.add("authority") + rl.add("sa") + rl.add("ma") + if (caller_hrn in pis): + rl.add("authority") rl.add("sa") - if (cred_object_hrn in operators): + if (caller_hrn in operators): + rl.add("authority") rl.add("ma") elif type == "user": @@ -176,6 +271,9 @@ class Auth: rl.add("resolve") rl.add("info") + elif type == "node": + rl.add("operator") + return rl def verify_cancreate_credential(self, src_cred, record): @@ -204,3 +302,20 @@ class Auth: def get_authority(self, hrn): return get_authority(hrn) + + def filter_creds_by_caller(self, creds, caller_hrn): + """ + Returns a list of creds who's gid caller matches the + specified caller hrn + """ + if not isinstance(creds, list): + creds = [creds] + creds = [] + for cred in creds: + try: + tmp_cred = Credential(string=cred) + if tmp_cred.get_gid_caller().get_hrn() == caller_hrn: + creds.append(cred) + except: pass + return creds +