From: Sandrine Avakian Date: Mon, 14 Nov 2011 10:03:30 +0000 (+0100) Subject: Changes to registry manager. SA. X-Git-Tag: sfa-2.1-24~3^2~313 X-Git-Url: http://git.onelab.eu/?p=sfa.git;a=commitdiff_plain;h=1ad00fe3faa1b0d00d79ba0a5ab56b10ff01efe8 Changes to registry manager. SA. --- diff --git a/sfa/managers/registry_manager_slab.py b/sfa/managers/registry_manager_slab.py index b30ca934..f3f18f75 100644 --- a/sfa/managers/registry_manager_slab.py +++ b/sfa/managers/registry_manager_slab.py @@ -16,13 +16,13 @@ from sfa.trust.gid import create_uuid from sfa.util.version import version_core from sfa.senslab.api import * -myapi=SfaAPI() +#myapi=SfaAPI() # The GENI GetVersion call def GetVersion(api): - peers =dict ([ (peername,v._ServerProxy__host) for (peername,v) in myapi.registries.iteritems() - if peername != myapi.hrn]) - xrn=Xrn(myapi.hrn) + peers =dict ([ (peername,v._ServerProxy__host) for (peername,v) in api.registries.iteritems() + if peername != api.hrn]) + xrn=Xrn(api.hrn) return version_core({'interface':'registry', 'hrn':xrn.get_hrn(), 'urn':xrn.get_urn(), @@ -36,12 +36,12 @@ def get_credential(api, xrn, type, is_self=False): hrn, type = urn_to_hrn(xrn) # Is this a root or sub authority - auth_hrn = myapi.auth.get_authority(hrn) + auth_hrn = api.auth.get_authority(hrn) print>> sys.stderr , " \r\n REGISTRY get_credential auth_hrn:" , auth_hrn,"hrn : ", hrn, " Type : ", type, "is self : " , is_self,"<<" - if not auth_hrn or hrn == myapi.config.SFA_INTERFACE_HRN: + if not auth_hrn or hrn == api.config.SFA_INTERFACE_HRN: auth_hrn = hrn # get record info - auth_info = myapi.auth.get_auth_info(auth_hrn) + auth_info = api.auth.get_auth_info(auth_hrn) table = SfaTable() print >> sys.stderr , " findObject ", type, hrn records = table.findObjects({'type': type, 'hrn': hrn}) @@ -52,7 +52,7 @@ def get_credential(api, xrn, type, is_self=False): # verify_cancreate_credential requires that the member lists # (researchers, pis, etc) be filled in - myapi.fill_record_info(record) + api.fill_record_info(record) record['enabled'] = True print>> sys.stderr , " \r\n ++ REGISTRY get_credential hrn %s record['enabled'] %s is_self %s" %(hrn, record['enabled'], is_self) if record['type']=='user': @@ -68,7 +68,7 @@ def get_credential(api, xrn, type, is_self=False): print>>sys.stderr, " \r\n REGISTRY IS SELF OK caller_hrn %s--- \r\n caller_gid %s---------" %(caller_hrn,caller_gid) else: print>> sys.stderr , " \r\n ++ ELSE " - caller_gid = myapi.auth.client_cred.get_gid_caller() + caller_gid = api.auth.client_cred.get_gid_caller() print>> sys.stderr , " \r\n ++ ELSE caller_gid %s record %s" %(caller_gid, record) caller_hrn = caller_gid.get_hrn() print>> sys.stderr , " \r\n ++ ELSE caller_hrn %s " %(caller_hrn) @@ -76,7 +76,7 @@ def get_credential(api, xrn, type, is_self=False): object_hrn = record.get_gid_object().get_hrn() print>> sys.stderr , " \r\n ++ ELSE object_hrn %s " %(object_hrn) - rights = myapi.auth.determine_user_rights(caller_hrn, record) + rights = api.auth.determine_user_rights(caller_hrn, record) print>> sys.stderr , " \r\n ++ After rights record: %s \r\n ====RIGHTS %s " %(record , rights) # make sure caller has rights to this object @@ -95,7 +95,7 @@ def get_credential(api, xrn, type, is_self=False): new_cred.set_expiration(int(record['expires'])) auth_kind = "authority,ma,sa" # Parent not necessary, verify with certs - #new_cred.set_parent(myapi.auth.hierarchy.get_auth_cred(auth_hrn, kind=auth_kind)) + #new_cred.set_parent(api.auth.hierarchy.get_auth_cred(auth_hrn, kind=auth_kind)) new_cred.encode() new_cred.sign() @@ -117,7 +117,7 @@ def resolve(api, xrns, type=None, full=True): # hrns at that registry (determined by the known prefix tree). xrn_dict = {} print >>sys.stderr, '\r\n REGISTRY MANAGER : resolve xrns ' , xrns #api.__dict__.keys() - registries = myapi.registries + registries = api.registries tree = prefixTree() registry_hrns = registries.keys() print >>sys.stderr, '\r\n \t\t REGISTRY MANAGER registry_hrns' , registry_hrns @@ -141,8 +141,8 @@ def resolve(api, xrns, type=None, full=True): # if the best match (longest matching hrn) is not the local registry, # forward the request xrns = xrn_dict[registry_hrn] - if registry_hrn != myapi.hrn: - credential = myapi.getCredential() + if registry_hrn != api.hrn: + credential = api.getCredential() peer_records = registries[registry_hrn].Resolve(xrns, credential) print >>sys.stderr , '\t\t peer_records ', peer_records records.extend([SfaRecord(dict=record).as_dict() for record in peer_records]) @@ -162,8 +162,8 @@ def resolve(api, xrns, type=None, full=True): print >>sys.stderr, '\t\t resolve regmanager : rec ', rec if full: - print >>sys.stderr, '\r\n \r\n REGISTRY:_FULL', myapi - myapi.fill_record_info(local_records) + print >>sys.stderr, '\r\n \r\n REGISTRY:_FULL', api + api.fill_record_info(local_records) # convert local record objects to dicts @@ -182,7 +182,7 @@ def list(api, xrn, origin_hrn=None): # load all know registry names into a prefix tree and attempt to find # the longest matching prefix records = [] - registries = myapi.registries + registries = api.registries registry_hrns = registries.keys() tree = prefixTree() tree.load(registry_hrns) @@ -195,14 +195,14 @@ def list(api, xrn, origin_hrn=None): # if the best match (longest matching hrn) is not the local registry, # forward the request records = [] - if registry_hrn != myapi.hrn: - credential = myapi.getCredential() + if registry_hrn != api.hrn: + credential = api.getCredential() record_list = registries[registry_hrn].List(xrn, credential) records = [SfaRecord(dict=record).as_dict() for record in record_list] # if we still have not found the record yet, try the local registry if not records: - if not myapi.auth.hierarchy.auth_exists(hrn): + if not api.auth.hierarchy.auth_exists(hrn): raise MissingAuthority(hrn) table = SfaTable() @@ -213,9 +213,10 @@ def list(api, xrn, origin_hrn=None): def register(api, record): - hrn = str(record['hrn']).strip("['']") - type_of_rec = str( record['type']).strip("['']") - + #hrn = str(record['hrn']).strip("['']") + #type_of_rec = str( record['type']).strip("['']") + hrn = record['hrn'] + type_of_rec =record['type'] urn = hrn_to_urn(hrn,type_of_rec) # validate the type @@ -235,12 +236,12 @@ def register(api, record): #record['authority'] = get_authority(record['hrn']) record['authority'] = get_authority(hrn) - #type_of_rec = record['type'] - #hrn = record['hrn'] + type_of_rec = record['type'] + hrn = record['hrn'] - #api.auth.verify_object_permission(hrn) - myapi.auth.verify_object_permission( record['hrn']) - auth_info = myapi.auth.get_auth_info(record['authority']) + api.auth.verify_object_permission(hrn) + #myapi.auth.verify_object_permission( record['hrn']) + auth_info = api.auth.get_auth_info(record['authority']) @@ -256,7 +257,7 @@ def register(api, record): pub_key = record['key'] pkey = convert_public_key(pub_key) - gid_object = myapi.auth.hierarchy.create_gid(urn, uuid, pkey) + gid_object = api.auth.hierarchy.create_gid(urn, uuid, pkey) gid = gid_object.save_to_string(save_parents=True) record['gid'] = gid record.set_gid(gid) @@ -266,19 +267,19 @@ def register(api, record): if type_of_rec in ["authority"]: # update the tree - if not myapi.auth.hierarchy.auth_exists(hrn): - myapi.auth.hierarchy.create_auth(hrn_to_urn(hrn,'authority')) + if not api.auth.hierarchy.auth_exists(hrn): + api.auth.hierarchy.create_auth(hrn_to_urn(hrn,'authority')) # get the GID from the newly created authority gid = auth_info.get_gid_object() record.set_gid(gid.save_to_string(save_parents=True)) - #pl_record = myapi.sfa_fields_to_pl_fields(type, hrn, record) + #pl_record = api.sfa_fields_to_pl_fields(type, hrn, record) print>>sys.stderr, " \r\n \r\n ----------- REGISTRY_MANAGER_SLAB.PY register : type_of_rec in [authority ] sfa_fields_to_pl_fields FIELDS A CHANGER" - sites = myapi.oar.GetSites( [pl_record['login_base']]) + sites = api.oar.GetSites( [pl_record['login_base']]) if not sites: - pointer = myapi.oar.AddSite( pl_record) + pointer = api.oar.AddSite( pl_record) else: pointer = sites[0]['site_id'] @@ -287,49 +288,49 @@ def register(api, record): elif (type_of_rec == "slice"): acceptable_fields=['url', 'instantiation', 'name', 'description'] - pl_record = myapi.sfa_fields_to_pl_fields(type_of_rec, hrn, record) + pl_record = api.sfa_fields_to_pl_fields(type_of_rec, hrn, record) print>>sys.stderr, " \r\n \r\n ----------- REGISTRY_MANAGER_SLAB.PY register slice pl_record %s"%(pl_record) for key in pl_record.keys(): if key not in acceptable_fields: pl_record.pop(key) - slices = myapi.users.GetSlices( [pl_record['name']]) + slices = api.users.GetSlices( [pl_record['name']]) if not slices: - pointer = myapi.users.AddSlice(pl_record) + pointer = api.users.AddSlice(pl_record) else: pointer = slices[0]['slice_id'] record.set_pointer(pointer) record['pointer'] = pointer elif (type_of_rec == "user"): - persons = myapi.users.GetPersons( [record['email']]) + persons = api.users.GetPersons( [record['email']]) if not persons: print>>sys.stderr, " \r\n \r\n ----------- registry_manager_slab register NO PERSON ADD TO LDAP?" #if not persons: - #pointer = myapi.users.AddPerson( dict(record)) + #pointer = api.users.AddPerson( dict(record)) #else: #pointer = persons[0]['person_id'] if 'enabled' in record and record['enabled']: - myapi.users.UpdatePerson( pointer, {'enabled': record['enabled']}) + api.users.UpdatePerson( pointer, {'enabled': record['enabled']}) # add this persons to the site only if he is being added for the first # time by sfa and doesont already exist in plc if not persons or not persons[0]['site_ids']: login_base = get_leaf(record['authority']) - myapi.users.AddPersonToSite( pointer, login_base) + api.users.AddPersonToSite( pointer, login_base) # What roles should this user have? - myapi.users.AddRoleToPerson( 'user', pointer) + api.users.AddRoleToPerson( 'user', pointer) # Add the user's key if pub_key: - myapi.users.AddPersonKey( pointer, {'key_type' : 'ssh', 'key' : pub_key}) + api.users.AddPersonKey( pointer, {'key_type' : 'ssh', 'key' : pub_key}) #elif (type == "node"): - #pl_record = myapi.sfa_fields_to_pl_fields(type, hrn, record) + #pl_record = api.sfa_fields_to_pl_fields(type, hrn, record) #login_base = hrn_to_pl_login_base(record['authority']) - #nodes = myapi.oar.GetNodes( [pl_record['hostname']]) + #nodes = api.oar.GetNodes( [pl_record['hostname']]) #if not nodes: - #pointer = myapi.oar.AddNode(login_base, pl_record) + #pointer = api.oar.AddNode(login_base, pl_record) #else: #pointer = nodes[0]['node_id'] @@ -339,7 +340,7 @@ def register(api, record): #record['record_id'] = record_id # update membership for researchers, pis, owners, operators - myapi.update_membership(None, record) + api.update_membership(None, record) return record.get_gid_object().save_to_string(save_parents=True) @@ -348,7 +349,7 @@ def update(api, record_dict): type = new_record['type'] hrn = new_record['hrn'] urn = hrn_to_urn(hrn,type) - myapi.auth.verify_object_permission(hrn) + api.auth.verify_object_permission(hrn) table = SfaTable() # make sure the record exists records = table.findObjects({'type': type, 'hrn': hrn}) @@ -359,7 +360,7 @@ def update(api, record_dict): # Update_membership needs the membership lists in the existing record # filled in, so it can see if members were added or removed - myapi.fill_record_info(record) + api.fill_record_info(record) # Use the pointer from the existing record, not the one that the user # gave us. This prevents the user from inserting a forged pointer @@ -367,13 +368,13 @@ def update(api, record_dict): # update the PLC information that was specified with the record if (type == "authority"): - myapi.oar.UpdateSite( pointer, new_record) + api.oar.UpdateSite( pointer, new_record) elif type == "slice": - pl_record=myapi.sfa_fields_to_pl_fields(type, hrn, new_record) + pl_record=api.sfa_fields_to_pl_fields(type, hrn, new_record) if 'name' in pl_record: pl_record.pop('name') - myapi.users.UpdateSlice( pointer, pl_record) + api.users.UpdateSlice( pointer, pl_record) elif type == "user": # SMBAKER: UpdatePerson only allows a limited set of fields to be @@ -386,14 +387,14 @@ def update(api, record_dict): 'password', 'phone', 'url', 'bio', 'accepted_aup', 'enabled']: update_fields[key] = all_fields[key] - myapi.users.UpdatePerson( pointer, update_fields) + api.users.UpdatePerson( pointer, update_fields) if 'key' in new_record and new_record['key']: # must check this key against the previous one if it exists - persons = myapi.users.GetPersons( [pointer], ['key_ids']) + persons = api.users.GetPersons( [pointer], ['key_ids']) person = persons[0] keys = person['key_ids'] - keys = myapi.users.GetKeys( person['key_ids']) + keys = api.users.GetKeys( person['key_ids']) key_exists = False if isinstance(new_record['key'], types.ListType): new_key = new_record['key'][0] @@ -403,29 +404,29 @@ def update(api, record_dict): # Delete all stale keys for key in keys: if new_record['key'] != key['key']: - myapi.users.DeleteKey( key['key_id']) + api.users.DeleteKey( key['key_id']) else: key_exists = True if not key_exists: - myapi.users.AddPersonKey( pointer, {'key_type': 'ssh', 'key': new_key}) + api.users.AddPersonKey( pointer, {'key_type': 'ssh', 'key': new_key}) # update the openssl key and gid pkey = convert_public_key(new_key) uuid = create_uuid() - gid_object = myapi.auth.hierarchy.create_gid(urn, uuid, pkey) + gid_object = api.auth.hierarchy.create_gid(urn, uuid, pkey) gid = gid_object.save_to_string(save_parents=True) record['gid'] = gid record = SfaRecord(dict=record) table.update(record) elif type == "node": - myapi.oar.UpdateNode( pointer, new_record) + api.oar.UpdateNode( pointer, new_record) else: raise UnknownSfaType(type) # update membership for researchers, pis, owners, operators - myapi.update_membership(record, new_record) + api.update_membership(record, new_record) return 1 @@ -444,33 +445,33 @@ def remove(api, xrn, origin_hrn=None): record = records[0] type = record['type'] - credential = myapi.getCredential() - registries = myapi.registries + credential = api.getCredential() + registries = api.registries # Try to remove the object from the PLCDB of federated agg. # This is attempted before removing the object from the local agg's PLCDB and sfa table - if hrn.startswith(myapi.hrn) and type in ['user', 'slice', 'authority']: + if hrn.startswith(api.hrn) and type in ['user', 'slice', 'authority']: for registry in registries: - if registry not in [myapi.hrn]: + if registry not in [api.hrn]: try: result=registries[registry].remove_peer_object(credential, record, origin_hrn) except: pass if type == "user": - persons = myapi.users.GetPersons(record['pointer']) + persons = api.users.GetPersons(record['pointer']) # only delete this person if he has site ids. if he doesnt, it probably means # he was just removed from a site, not actually deleted if persons and persons[0]['site_ids']: - myapi.users.DeletePerson(record['pointer']) + api.users.DeletePerson(record['pointer']) elif type == "slice": - if myapi.users.GetSlices( record['pointer']): - myapi.users.DeleteSlice( record['pointer']) + if api.users.GetSlices( record['pointer']): + api.users.DeleteSlice( record['pointer']) elif type == "node": - if myapi.oar.GetNodes( record['pointer']): - myapi.oar.DeleteNode( record['pointer']) + if api.oar.GetNodes( record['pointer']): + api.oar.DeleteNode( record['pointer']) elif type == "authority": - if myapi.oar.GetSites( record['pointer']): - myapi.oar.DeleteSite( record['pointer']) + if api.oar.GetSites( record['pointer']): + api.oar.DeleteSite( record['pointer']) else: raise UnknownSfaType(type)