these two lines, if enabled, allow a credential to operate on all target hrn. tony...

diff --git a/sfa/trust/auth.py b/sfa/trust/auth.py
index 923bed4..298d032 100644 (file)
--- a/sfa/trust/auth.py
+++ b/sfa/trust/auth.py
@@ -123,8 +123,8 @@ class Auth:
             return
         if name.startswith(object_hrn + "."):
             return
-        if name.startswith(get_authority(name)):
-            return
+        #if name.startswith(get_authority(name)):
+            #return
     
         raise PermissionError(name)