From: Tony Mack <tmack@cs.princeton.edu>
Date: Thu, 15 Oct 2009 05:01:21 +0000 (+0000)
Subject: added request_hash argument. authenticate the credential using request_hash
X-Git-Tag: sfa-0.9-6~176
X-Git-Url: http://git.onelab.eu/?p=sfa.git;a=commitdiff_plain;h=eddcc8a722b907cd4b1df9fb3ee6964d15b94ea0

added request_hash argument. authenticate the credential using request_hash
---

diff --git a/sfa/methods/get_credential.py b/sfa/methods/get_credential.py
index f6f34d65..5b5922cd 100644
--- a/sfa/methods/get_credential.py
+++ b/sfa/methods/get_credential.py
@@ -29,15 +29,18 @@ class get_credential(Method):
     accepts = [
         Mixed(Parameter(str, "credential"),
               Parameter(None, "No credential")),  
-        Parameter(str, "Human readable name (hrn)")
+        Parameter(str, "Human readable name (hrn)"),
+        Parameter(str, "Request hash")
         ]
 
     returns = Parameter(str, "String representation of a credential object")
 
-    def call(self, cred, type, hrn):
+    def call(self, cred, type, hrn, request_hash):
         if not cred:
-            return self.get_self_credential(type, hrn)
+            return self.get_self_credential(type, hrn, request_hash)
 
+        # authenticate the cred
+        self.api.auth.authenticateCred(cred, [cred, type, hrn], request_hash)
         self.api.auth.check(cred, 'getcredential')
         self.api.auth.verify_object_belongs_to_me(hrn)
         auth_hrn = self.api.auth.get_authority(hrn)
@@ -80,7 +83,7 @@ class get_credential(Method):
 
         return new_cred.save_to_string(save_parents=True)
 
-    def get_self_credential(self, type, hrn):
+    def get_self_credential(self, type, hrn, request_hash):
         """
         get_self_credential a degenerate version of get_credential used by a client
         to get his initial credential when de doesnt have one. This is the same as
@@ -98,8 +101,9 @@ class get_credential(Method):
         """
         self.api.auth.verify_object_belongs_to_me(hrn)
         auth_hrn = self.api.auth.get_authority(hrn)
-        
-        # is this a root or sub authority
+         
+        # if this is a root or sub authority get_authority will return
+        # an empty string
         if not auth_hrn or hrn == self.api.config.SFA_INTERFACE_HRN:
             auth_hrn = hrn
 
@@ -113,13 +117,13 @@ class get_credential(Method):
             raise RecordNotFound(hrn)
         record = records[0]
         gid = record.get_gid_object()
-        peer_cert = self.api.auth.peer_cert
-        if not peer_cert.is_pubkey(gid.get_pubkey()):
-           raise ConnectionKeyGIDMismatch(gid.get_subject())
-
         rights = self.api.auth.determine_user_rights(None, record)
         if rights.is_empty():
             raise PermissionError(gid.get_hrn() + " has no rights to " + record.get_name())
+       
+        # authenticate the gid
+        gid_str = gid.save_to_string(save_parents=True)
+        self.api.auth.authenticateGid(gid_str, [None, type, hrn], request_hash)
 
         # create the credential
         gid = record.get_gid_object()
@@ -136,5 +140,4 @@ class get_credential(Method):
 
         cred.encode()
         cred.sign()
-
         return cred.save_to_string(save_parents=True)
diff --git a/sfa/methods/list.py b/sfa/methods/list.py
index 73631c76..75327f22 100644
--- a/sfa/methods/list.py
+++ b/sfa/methods/list.py
@@ -23,13 +23,14 @@ class list(Method):
     
     accepts = [
         Parameter(str, "Credential string"),
-        Parameter(str, "Human readable name (hrn)")
+        Parameter(str, "Human readable name (hrn)"),
+        Parameter(str, "Request hash")
         ]
 
     returns = [GeniRecord]
     
-    def call(self, cred, hrn, caller_cred=None):
-
+    def call(self, cred, hrn, request_hash, caller_cred=None):
+        self.api.auth.authenticateCred(cred, [cred, hrn], request_hash)
         self.api.auth.check(cred, 'list')
         if caller_cred==None:
             caller_cred=cred
diff --git a/sfa/methods/register.py b/sfa/methods/register.py
index 6c4820a8..b266a649 100644
--- a/sfa/methods/register.py
+++ b/sfa/methods/register.py
@@ -31,12 +31,14 @@ class register(Method):
     
     accepts = [
         Parameter(str, "Credential string"),
-        Parameter(dict, "Record dictionary containing record fields")
+        Parameter(dict, "Record dictionary containing record fields"),
+        Parameter(str, "Request hash")
         ]
 
     returns = Parameter(int, "String representation of gid object")
     
-    def call(self, cred, record_dict, caller_cred=None):
+    def call(self, cred, record_dict, request_hash, caller_cred=None):
+        self.api.auth.authenticateCred(cred, [cred, record_dict], request_hash)
         self.api.auth.check(cred, "register")
         if caller_cred==None:
 	        caller_cred=cred
diff --git a/sfa/methods/resolve.py b/sfa/methods/resolve.py
index 65582b58..acf6ec08 100644
--- a/sfa/methods/resolve.py
+++ b/sfa/methods/resolve.py
@@ -25,13 +25,15 @@ class resolve(Method):
     
     accepts = [
         Parameter(str, "Credential string"),
-        Parameter(str, "Human readable name (hrn)")
+        Parameter(str, "Human readable name (hrn)"),
+        Parameter(str, "Request hash")
         ]
 
     returns = [GeniRecord]
     
-    def call(self, cred, hrn, caller_cred=None):
+    def call(self, cred, hrn, request_hash, caller_cred=None):
         
+        self.api.auth.authenticateCred(cred, [cred, hrn], request_hash) 
         self.api.auth.check(cred, 'resolve')
         if caller_cred==None:
             caller_cred=cred