X-Git-Url: http://git.onelab.eu/?p=sfa.git;a=blobdiff_plain;f=sfa%2Ftrust%2Fauth.py;h=c3dbc46432b2345a2c7a93af0fb9bda041e20b9a;hp=2f1cd2a5a7e327acc997a1edd20837bfe7890dea;hb=1e95f8a388325499564df5f8eb6eb1fd10ca2d42;hpb=6ef67c3657be04f28d6e88b84c8a023896ff8328 diff --git a/sfa/trust/auth.py b/sfa/trust/auth.py index 2f1cd2a5..c3dbc464 100644 --- a/sfa/trust/auth.py +++ b/sfa/trust/auth.py @@ -1,21 +1,18 @@ # -# GeniAPI authentication +# SfaAPI authentication # -### $Id$ -### $URL$ -# - -import time +import sys +from sfa.trust.certificate import Keypair, Certificate from sfa.trust.credential import Credential -from sfa.trust.trustedroot import TrustedRootList -from sfa.trust.rights import RightList +from sfa.trust.trustedroots import TrustedRoots from sfa.util.faults import * from sfa.trust.hierarchy import Hierarchy -from sfa.util.genitable import GeniTable from sfa.util.config import * -from sfa.util.misc import * -from sfa.trust.gid import GID +from sfa.util.xrn import get_authority +from sfa.trust.sfaticket import SfaTicket + +from sfa.util.sfalogging import logger class Auth: """ @@ -27,15 +24,41 @@ class Auth: self.hierarchy = Hierarchy() if not config: self.config = Config() - self.trusted_cert_list = TrustedRootList(self.config.get_trustedroots_dir()).get_list() + self.load_trusted_certs() + def load_trusted_certs(self): + self.trusted_cert_list = TrustedRoots(self.config.get_trustedroots_dir()).get_list() + self.trusted_cert_file_list = TrustedRoots(self.config.get_trustedroots_dir()).get_file_list() - def check(self, cred, operation): + + + def checkCredentials(self, creds, operation, hrn = None): + valid = [] + if not isinstance(creds, list): + creds = [creds] + logger.debug("Auth.checkCredentials with %d creds"%len(creds)) + for cred in creds: + try: + self.check(cred, operation, hrn) + valid.append(cred) + except: + cred_obj=Credential(string=cred) + logger.debug("failed to validate credential - dump=%s"%cred_obj.dump_string(dump_parents=True)) + error = sys.exc_info()[:2] + continue + + if not len(valid): + raise InsufficientRights('Access denied: %s -- %s' % (error[0],error[1])) + + return valid + + + def check(self, cred, operation, hrn = None): """ Check the credential against the peer cert (callerGID included in the credential matches the caller that is connected to the HTTPS connection, check if the credential was signed by a - trusted cert and check if the credential is allowd to perform + trusted cert and check if the credential is allowed to perform the specified operation. """ self.client_cred = Credential(string = cred) @@ -56,27 +79,36 @@ class Auth: raise InsufficientRights(operation) if self.trusted_cert_list: - self.client_cred.verify_chain(self.trusted_cert_list) - if self.client_gid: - self.client_gid.verify_chain(self.trusted_cert_list) - if self.object_gid: - self.object_gid.verify_chain(self.trusted_cert_list) - + self.client_cred.verify(self.trusted_cert_file_list, self.config.SFA_CREDENTIAL_SCHEMA) + else: + raise MissingTrustedRoots(self.config.get_trustedroots_dir()) + + # Make sure the credential's target matches the specified hrn. + # This check does not apply to trusted peers + trusted_peers = [gid.get_hrn() for gid in self.trusted_cert_list] + if hrn and self.client_gid.get_hrn() not in trusted_peers: + target_hrn = self.object_gid.get_hrn() + if not hrn == target_hrn: + raise PermissionError("Target hrn: %s doesn't match specified hrn: %s " % \ + (target_hrn, hrn) ) return True - def verifyPeerCert(self, cert, gid): - # make sure the client_gid matches client's certificate - if not cert: - peer_cert = self.peer_cert + def check_ticket(self, ticket): + """ + Check if the tickt was signed by a trusted cert + """ + if self.trusted_cert_list: + client_ticket = SfaTicket(string=ticket) + client_ticket.verify_chain(self.trusted_cert_list) else: - peer_cert = cert + raise MissingTrustedRoots(self.config.get_trustedroots_dir()) - if not gid: - peer_gid = self.client_gid - else: - peer_gid = gid - if not peer_cert.is_pubkey(peer_gid.get_pubkey()): - raise ConnectionKeyGIDMismatch(peer_gid.get_subject()) + return True + + def verifyPeerCert(self, cert, gid): + # make sure the client_gid matches client's certificate + if not cert.is_pubkey(gid.get_pubkey()): + raise ConnectionKeyGIDMismatch(gid.get_subject()+":"+cert.get_subject()) def verifyGidRequestHash(self, gid, hash, arglist): key = gid.get_pubkey() @@ -93,13 +125,7 @@ class Auth: def validateCred(self, cred): if self.trusted_cert_list: - cred.verify_chain(self.trusted_cert_list) - caller_gid = cred.get_gid_caller() - object_gid = cred.get_gid_object() - if caller_gid: - caller_gid.verify_chain(self.trusted_cert_list) - if object_gid: - object_gid.verify_chain(self.trusted_cert_list) + cred.verify(self.trusted_cert_file_list) def authenticateGid(self, gidStr, argList, requestHash=None): gid = GID(string = gidStr) @@ -135,7 +161,7 @@ class Auth: caller_gid = cred.get_gid_caller() caller_hrn = caller_gid.get_hrn() if caller_hrn != self.config.SFA_INTERFACE_HRN: - raise GeniPermissionError(self.config.SFA_INTEFACE_HRN) + raise SfaPermissionDenied(self.config.SFA_INTEFACE_HRN) return @@ -203,34 +229,23 @@ class Auth: raise PermissionError(name) - def determine_user_rights(self, src_cred, record): + def determine_user_rights(self, caller_hrn, record): """ Given a user credential and a record, determine what set of rights the user should have to that record. - - Src_cred can be None when obtaining a user credential, but should be - set to a valid user credential when obtaining a slice or authority - credential. - + This is intended to replace determine_rights() and verify_cancreate_credential() """ + rl = Rights() type = record['type'] - if src_cred: - cred_object_hrn = src_cred.get_gid_object().get_hrn() - else: - # supplying src_cred==None is only valid when obtaining user - # credentials. - #assert(type == "user") - - cred_object_hrn = None - rl = RightList() if type=="slice": researchers = record.get("researcher", []) - if (cred_object_hrn in researchers): + pis = record.get("PI", []) + if (caller_hrn in researchers + pis): rl.add("refresh") rl.add("embed") rl.add("bind") @@ -238,20 +253,27 @@ class Auth: rl.add("info") elif type == "authority": - pis = record.get("pi", []) + pis = record.get("PI", []) operators = record.get("operator", []) - if (cred_object_hrn == config.SFA_INTERFACE_HRN): + if (caller_hrn == self.config.SFA_INTERFACE_HRN): + rl.add("authority") + rl.add("sa") + rl.add("ma") + if (caller_hrn in pis): rl.add("authority") - if (cred_object_hrn in pis): - rl.add("authority,sa") - if (cred_object_hrn in operators): - rl.add("authority,ma") + rl.add("sa") + if (caller_hrn in operators): + rl.add("authority") + rl.add("ma") elif type == "user": rl.add("refresh") rl.add("resolve") rl.add("info") + elif type == "node": + rl.add("operator") + return rl def verify_cancreate_credential(self, src_cred, record): @@ -280,3 +302,22 @@ class Auth: def get_authority(self, hrn): return get_authority(hrn) + + def filter_creds_by_caller(self, creds, caller_hrn_list): + """ + Returns a list of creds who's gid caller matches the + specified caller hrn + """ + if not isinstance(creds, list): + creds = [creds] + creds = [] + if not isinistance(caller_hrn_list, list): + caller_hrn_list = [caller_hrn_list] + for cred in creds: + try: + tmp_cred = Credential(string=cred) + if tmp_cred.get_gid_caller().get_hrn() in [caller_hrn_list]: + creds.append(cred) + except: pass + return creds +