1 ### $Id: get_credential.py 15321 2009-10-15 05:01:21Z tmack $
2 ### $URL: https://svn.planet-lab.org/svn/sfa/trunk/sfa/methods/get_credential.py $
4 from sfa.trust.credential import *
5 from sfa.trust.rights import *
6 from sfa.util.faults import *
7 from sfa.util.method import Method
8 from sfa.util.parameter import Parameter, Mixed
9 from sfa.trust.auth import Auth
10 from sfa.trust.gid import GID
11 from sfa.util.record import GeniRecord
12 from sfa.util.genitable import *
13 from sfa.util.debug import log
15 class get_self_credential(Method):
17 Retrive a credential for an object
18 @param cert certificate string
19 @param type type of object (user | slice | sa | ma | node)
20 @param hrn human readable name of object
22 @return the string representation of a credential object
25 interfaces = ['registry']
28 Parameter(str, "certificate"),
29 Parameter(str, "Human readable name (hrn)"),
30 Parameter(str, "Request hash")
33 returns = Parameter(str, "String representation of a credential object")
35 def call(self, cert, type, hrn, request_hash):
37 get_self_credential a degenerate version of get_credential used by a client
38 to get his initial credential when de doesnt have one. This is the same as
39 get_credetial(..., cred = None, ...)
41 The registry ensures that the client is the principal that is named by
42 (type, name) by comparing the public key in the record's GID to the
43 private key used to encrypt the client side of the HTTPS connection. Thus
44 it is impossible for one principal to retrive another principal's
45 credential without having the appropriate private key.
47 @param type type of object (user | slice | sa | ma | node)
48 @param hrn human readable name of authority to list
49 @return string representation of a credential object
51 self.api.auth.verify_object_belongs_to_me(hrn)
52 auth_hrn = self.api.auth.get_authority(hrn)
54 # if this is a root or sub authority get_authority will return
56 if not auth_hrn or hrn == self.api.config.SFA_INTERFACE_HRN:
59 auth_info = self.api.auth.get_auth_info(auth_hrn)
61 # find a record that matches
64 records = table.findObjects({'type': type, 'hrn': hrn})
66 raise RecordNotFound(hrn)
69 # get the right of this record
70 rights = self.api.auth.determine_user_rights(None, record)
72 raise PermissionError(gid.get_hrn() + " has no rights to " + record.get_name())
74 # authenticate the gid
75 gid = record.get_gid_object()
76 gid_str = gid.save_to_string(save_parents=True)
77 self.api.auth.authenticateGid(gid_str, [cert, type, hrn], request_hash)
79 # authenticate the certificate
80 certificate = Certificate(string=cert)
81 if not certificate.is_pubkey(gid.get_pubkey()):
82 raise ConnectionKeyGIDMismatch(gid.get_subject())
84 # create the credential
85 gid = record.get_gid_object()
86 cred = Credential(subject = gid.get_subject())
87 cred.set_gid_caller(gid)
88 cred.set_gid_object(gid)
89 cred.set_issuer(key=auth_info.get_pkey_object(), subject=auth_hrn)
90 cred.set_pubkey(gid.get_pubkey())
91 cred.set_privileges(rights)
92 cred.set_delegate(True)
94 auth_kind = "authority,sa,ma"
95 cred.set_parent(self.api.auth.hierarchy.get_auth_cred(auth_hrn, kind=auth_kind))
99 return cred.save_to_string(save_parents=True)