git://git.onelab.eu
/
sfa.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
c2e91d1
)
determine user rights reqires the hrn of the caller instead of a cred (which may...
author
Tony Mack
<tmack@cs.princeton.edu>
Thu, 29 Oct 2009 18:36:33 +0000
(18:36 +0000)
committer
Tony Mack
<tmack@cs.princeton.edu>
Thu, 29 Oct 2009 18:36:33 +0000
(18:36 +0000)
sfa/trust/auth.py
patch
|
blob
|
history
diff --git
a/sfa/trust/auth.py
b/sfa/trust/auth.py
index
2f1cd2a
..
6faa397
100644
(file)
--- a/
sfa/trust/auth.py
+++ b/
sfa/trust/auth.py
@@
-203,34
+203,21
@@
class Auth:
raise PermissionError(name)
raise PermissionError(name)
- def determine_user_rights(self,
src_cred
, record):
+ def determine_user_rights(self,
caller_hrn
, record):
"""
Given a user credential and a record, determine what set of rights the
user should have to that record.
"""
Given a user credential and a record, determine what set of rights the
user should have to that record.
-
- Src_cred can be None when obtaining a user credential, but should be
- set to a valid user credential when obtaining a slice or authority
- credential.
-
+
This is intended to replace determine_rights() and
verify_cancreate_credential()
"""
This is intended to replace determine_rights() and
verify_cancreate_credential()
"""
- type = record['type']
- if src_cred:
- cred_object_hrn = src_cred.get_gid_object().get_hrn()
- else:
- # supplying src_cred==None is only valid when obtaining user
- # credentials.
- #assert(type == "user")
-
- cred_object_hrn = None
-
rl = RightList()
rl = RightList()
+ type = record['type']
if type=="slice":
researchers = record.get("researcher", [])
if type=="slice":
researchers = record.get("researcher", [])
- if (c
red_object
_hrn in researchers):
+ if (c
aller
_hrn in researchers):
rl.add("refresh")
rl.add("embed")
rl.add("bind")
rl.add("refresh")
rl.add("embed")
rl.add("bind")
@@
-240,11
+227,11
@@
class Auth:
elif type == "authority":
pis = record.get("pi", [])
operators = record.get("operator", [])
elif type == "authority":
pis = record.get("pi", [])
operators = record.get("operator", [])
- if (c
red_object
_hrn == config.SFA_INTERFACE_HRN):
+ if (c
aller
_hrn == config.SFA_INTERFACE_HRN):
rl.add("authority")
rl.add("authority")
- if (c
red_object
_hrn in pis):
+ if (c
aller
_hrn in pis):
rl.add("authority,sa")
rl.add("authority,sa")
- if (c
red_object
_hrn in operators):
+ if (c
aller
_hrn in operators):
rl.add("authority,ma")
elif type == "user":
rl.add("authority,ma")
elif type == "user":