r5271 - branches
by tmckay@fedoraproject.org
Author: tmckay
Date: 2012-03-25 19:57:53 +0000 (Sun, 25 Mar 2012)
New Revision: 5271
Added:
branches/roles_II/
Log:
Try out an alternate idea using logical modules
12 years, 1 month
r5270 - branches
by tmckay@fedoraproject.org
Author: tmckay
Date: 2012-03-23 19:19:07 +0000 (Fri, 23 Mar 2012)
New Revision: 5270
Added:
branches/play_plumage/
Log:
Exploratory branch for plumage integration
12 years, 1 month
Role enforcement, continuing
by Trevor McKay
Added a bunch of checks for legitimate roles, made some redirection
cases a little better. Extended cumin-admin with a simple add-role
command for development.
One issue I ran into is that there are lots of classes not addressed in
usergrid.xml. For instance, clicking on a Submission as a "user" brings
up a job list for the Submission, but a lot things are missing here --
task buttons, task lists, column headers, etc. I added a few but
stopped.
I started playing with turning on authorization only on Page widgets,
and allowing everything else by default. This worked well for the User
case -- all of the missing widgets started working, but the user was
still restricted from the index.html page.
With something like "messagingadmin" or "genericadmin", this approach
could be extended by turning on authorization selectively for certain
frames or tabs at a high level.
The advantage is that usergrid.xml does not have to control visibility
at such find granularity and we will not accidentally screen out new
widgets (or miss some in testing). Since rendering passes from parents
to children, restrictions on parents should still catch violations even
if the children are not protected.
This may be a good alternative approach.
We've mentioned module-based authorization in he past. What is the
theory behind it? How will it work?
Best,
Trevor
12 years, 1 month
r5269 - in branches/roles: cumin/bin cumin/model/access cumin/python/cumin cumin/python/cumin/account wooly/python/wooly
by tmckay@fedoraproject.org
Author: tmckay
Date: 2012-03-23 17:52:00 +0000 (Fri, 23 Mar 2012)
New Revision: 5269
Modified:
branches/roles/cumin/bin/cumin-admin
branches/roles/cumin/model/access/usergrid.xml
branches/roles/cumin/python/cumin/account/widgets.py
branches/roles/cumin/python/cumin/account/widgets.strings
branches/roles/cumin/python/cumin/authorize.py
branches/roles/cumin/python/cumin/widgets.py
branches/roles/wooly/python/wooly/__init__.py
branches/roles/wooly/python/wooly/pages.py
Log:
Multiple changes:
* Added add-role command to cumin-admin (probably needs remove-role, too, which also needs to scan users)
* Added a few widgets to the user role in usergrid.xml. There are many items missing.
* Experimented with a do_authorize flag on Widgets, default to False. Currently ignored. This allowed turning on
authorization checks just on HtmlPage widgets.
* Added checks for valid roles on user at login, with message on failure
* Redirect "automatic" login to the login page when there are no valid roles
* Fix redirection on missing object to go to the fallback page, not index.html
* Fix PageError to store exceptions rather than just calling print_exc()
Modified: branches/roles/cumin/bin/cumin-admin
===================================================================
--- branches/roles/cumin/bin/cumin-admin 2012-03-23 00:06:59 UTC (rev 5268)
+++ branches/roles/cumin/bin/cumin-admin 2012-03-23 17:52:00 UTC (rev 5269)
@@ -125,6 +125,7 @@
lines.append("User commands:")
lines.append("")
lines.append(" add-user USER [PASSWORD] Add USER")
+ lines.append(" add-role ROLE Add ROLE")
lines.append(" external-user USER Add USER with external authentication")
lines.append(" external-sync AUTH [VERBOSE] Batch import users with external authentication")
lines.append(" AUTH is the name of a mechanism like 'ldap' or 'script'")
@@ -402,6 +403,22 @@
print("\nNo users removed.")
+def handle_add_role(app, cursor, opts, args):
+ try:
+ name = args[0]
+ except IndexError:
+ error("ROLE is required")
+
+ if app.admin.get_role(cursor, name):
+ error("A role called '%s' already exists" % name)
+
+ try:
+ app.admin.add_role(cursor, name)
+ except IntegrityError:
+ error("A role called '%s' already exists" % name)
+
+ print "Role '%s' is added" % name
+
def handle_add_user(app, cursor, opts, args):
try:
name = args[0]
Modified: branches/roles/cumin/model/access/usergrid.xml
===================================================================
--- branches/roles/cumin/model/access/usergrid.xml 2012-03-23 00:06:59 UTC (rev 5268)
+++ branches/roles/cumin/model/access/usergrid.xml 2012-03-23 17:52:00 UTC (rev 5269)
@@ -16,6 +16,9 @@
<WidgetAccess reg="cumin.widgets.About*" />
<WidgetAccess reg="cumin.widgets.CuminFormPage" />
<WidgetAccess reg="cumin.grid.submission.*" />
+ <WidgetAccess reg="cumin.objectframe.*" />
+ <WidgetAccess reg="cumin.widgets.Notification*" />
+ <WidgetAccess reg="cumin.grid.job.*" />
<FallbackPage name="usergrid.html"/>
</GroupAccess>
<GroupAccess name="admin">
Modified: branches/roles/cumin/python/cumin/account/widgets.py
===================================================================
--- branches/roles/cumin/python/cumin/account/widgets.py 2012-03-23 00:06:59 UTC (rev 5268)
+++ branches/roles/cumin/python/cumin/account/widgets.py 2012-03-23 17:52:00 UTC (rev 5269)
@@ -124,19 +124,27 @@
user = cls.get_object(cursor, name=name)
if not user:
- self.login_invalid.set(session, True)
+ self.login_invalid.set(session, "credentials")
return
authenticated = self.app.authenticator.authenticate(name,password)
if authenticated:
- # You're in!
- login = LoginSession(self.app, user)
+ # You're in! almost...
+ # Check for a valid group if group authorization is on
+ if self.app.authorizator.is_enforcing():
+ roles = self.app.admin.get_roles_for_user(cursor, user)
+ if not self.app.authorizator.contains_valid_group(roles):
+ self.login_invalid.set(session, "roles")
+ return
+ else:
+ roles = []
+ login = LoginSession(self.app, user, roles)
session.client_session.attributes["login_session"] = login
url = self.page.origin.get(session)
self.page.redirect.set(session, url)
else:
- self.login_invalid.set(session, True)
+ self.login_invalid.set(session, "credentials")
def render_operator_link(self, session):
email = self.app.operator_email
@@ -147,7 +155,10 @@
return "site operator"
def render_login_invalid(self, session):
- if self.login_invalid.get(session):
+ reason = self.login_invalid.get(session)
+ if reason == "roles":
+ return self.get_string("roles_invalid")
+ elif reason == "credentials":
return self.get_string("login_invalid")
class Submit(FormButton):
Modified: branches/roles/cumin/python/cumin/account/widgets.strings
===================================================================
--- branches/roles/cumin/python/cumin/account/widgets.strings 2012-03-23 00:06:59 UTC (rev 5268)
+++ branches/roles/cumin/python/cumin/account/widgets.strings 2012-03-23 17:52:00 UTC (rev 5269)
@@ -77,3 +77,7 @@
<p class="login_invalid">The user name and password you entered do not
match any account.</p>
+[LoginForm.roles_invalid]
+<p class="login_invalid">There are no valid roles
+configured for this account.</p>
+
Modified: branches/roles/cumin/python/cumin/authorize.py
===================================================================
--- branches/roles/cumin/python/cumin/authorize.py 2012-03-23 00:06:59 UTC (rev 5268)
+++ branches/roles/cumin/python/cumin/authorize.py 2012-03-23 17:52:00 UTC (rev 5269)
@@ -92,6 +92,9 @@
log.error("Access file '%s' does not parse!" % accfile)
log.info("MODULES %s", modules)
+ def is_enforcing(self):
+ return self.access_path is not None
+
def map_is_empty(self):
return self.accmap.map_is_empty()
@@ -108,8 +111,14 @@
group = group[0]
return self.accmap.find_fallback(group)
- def authorize(self,web_session, widget_name):
- if self.access_path is None:
+ def contains_valid_group(self, groups):
+ for g in groups:
+ if g in self.accmap.mapping:
+ return True
+ return False
+
+ def authorize(self, web_session, widget):
+ if not self.is_enforcing(): # or not widget.do_authorize:
# The feature is disabled, everything is allowed
return True
try:
@@ -120,17 +129,17 @@
#TODO: bleee ugly ugly ... -> CuminGenericWidget ? .
# skip wooly widgets ....
- if widget_name.startswith("wooly"):
+ if widget.my_name.startswith("wooly"):
return True
if type(group) == type([]):
for g in group:
- if self.accmap.lookup(g,widget_name):
+ if self.accmap.lookup(g, widget.my_name):
log.debug("Allowing %s authorization for %s ",
- widget_name, group)
+ widget.my_name, group)
return True
else:
- return self.accmap.lookup(group,widget_name)
+ return self.accmap.lookup(group,widget.my_name)
- log.debug("Denying %s authorization for %s ", widget_name, group)
+ log.debug("Denying %s authorization for %s ", widget.my_name, group)
return False
Modified: branches/roles/cumin/python/cumin/widgets.py
===================================================================
--- branches/roles/cumin/python/cumin/widgets.py 2012-03-23 00:06:59 UTC (rev 5268)
+++ branches/roles/cumin/python/cumin/widgets.py 2012-03-23 17:52:00 UTC (rev 5269)
@@ -104,7 +104,7 @@
href = Session(page).marshal()
title = page.render_title(session)
#TODO: generalize ??
- if self.app.authorize_cb(session,page.my_name):
+ if self.app.authorize_cb(session, page):
return fmt_link(href, title)
def render_item_class(self, session, page):
@@ -1177,16 +1177,11 @@
# XXX this should move somewhere else
class LoginSession(object):
- def __init__(self, app, user):
+ def __init__(self, app, user, group):
self.app = app
self.user = user
-
- conn = self.app.database.get_connection()
- cursor = conn.cursor()
- self.group = self.app.admin.get_roles_for_user(cursor, user)
-
+ self.group = group
self.created = datetime.now()
-
self.notifications = list()
class NotificationSet(Widget):
@@ -1314,12 +1309,11 @@
return True
login = session.client_session.attributes.get("login_session")
-
if login:
when = datetime.now() - timedelta(hours=24)
-
if login.created > when:
return True
+
elif self.app.auth_proxy or self.app.user:
username = self.app.user
# proxy user overrides app defined user
@@ -1328,35 +1322,57 @@
except KeyError:
log.debug("Proxy auth enabled but no remote user set")
pass
+
if username:
cls = self.app.model.com_redhat_cumin.User
users = cls.get_selection(session.cursor, name=username)
+ if not users:
+ if not self.app.auth_proxy:
+ log.info("User '%s' not found" % username)
+ else:
+ log.info("User %s not found in db, "\
+ "using auth proxy", username )
+ #Hmmm, what is users here? For now just let it return
+ # to the login page
+ return False
- if not users and not self.app.auth_proxy:
- raise Exception("User '%s' not found" % self.app.user)
- else:
- log.info("User %s not found in db", username )
#TODO prehodit do authenticatora
# ondemand -> authenticator.create_user
# user -> authenticator.force_login
- login = LoginSession(self.app, users[0])
+ # Check for valid group
+ if self.app.authorizator.is_enforcing():
+ cursor = self.app.database.get_read_cursor()
+ roles = self.app.admin.get_roles_for_user(cursor, users[0])
+ if not self.app.authorizator.contains_valid_group(roles):
+ log.info("No valid roles for '%s'" % username)
+ return False # go to login page
+ else:
+ roles = []
+
+ login = LoginSession(self.app, users[0], roles)
session.client_session.attributes["login_session"] = login
-
return True
return False
def redirect_on_exception(self, session):
# If we have an exception from a missing object, redirect to the
# main page with a notice instead of using the not_found_tmpl below.
- # Test for presence on the index.html page already to avoid any possibility
+ # Test for presence on the main page already to avoid any possibility
# of an infinite redirect loop.
cls, value, traceback = sys.exc_info()
+ if self.app.authorizator.is_enforcing():
+ mainpage = self.app.authorizator.find_fallback(session)
+ if not mainpage.startswith("/"):
+ mainpage = "/" + mainpage
+ else:
+ mainpage = "/index.html"
+
if cls is RosemaryNotFound and \
- session.request_environment["REQUEST_URI"] != "/index.html":
+ session.request_environment["REQUEST_URI"] != mainpage:
session.add_notice(Notice("An object being displayed became unavailable"))
- return "/index.html"
+ return mainpage
def render_error(self, session):
cls, value, traceback = sys.exc_info()
Modified: branches/roles/wooly/python/wooly/__init__.py
===================================================================
--- branches/roles/wooly/python/wooly/__init__.py 2012-03-23 00:06:59 UTC (rev 5268)
+++ branches/roles/wooly/python/wooly/__init__.py 2012-03-23 17:52:00 UTC (rev 5269)
@@ -2,7 +2,7 @@
from resources import ResourceFinder
from template import *
from util import *
-
+from traceback import print_exception
log = logging.getLogger("wooly")
strings = StringCatalog(__file__)
@@ -126,6 +126,7 @@
self.nocontent_tmpl = WidgetTemplate(self, "nocontent")
self.my_name = self.__class__.__module__ + '.' + self.__class__.__name__
+ self.do_authorize = False
def init(self):
log.debug("Initializing %s" % self)
@@ -295,7 +296,7 @@
def process(self, session, *args):
#TODO: cleanup
log.debug("WOOLY PROCESS: %s", self.my_name)
- if not self.app.authorize_cb(session, self.my_name):
+ if not self.app.authorize_cb(session, self):
self.redirect_on_not_authorized(session)
else:
if self.update_enabled:
@@ -319,7 +320,7 @@
def render(self, session, *args):
#TODO: cleanup
log.debug("WOOLY RENDER: %s", self.my_name)
- if not self.app.authorize_cb(session, self.my_name):
+ if not self.app.authorize_cb(session, self):
return ""
if self.app.debug:
profile = self.page.profile.get(session)
@@ -503,7 +504,12 @@
return None
def service_error(self, session):
- self.error.set(session, PageError(self, session))
+ # Well, we can have other handled exceptions pop up before
+ # we actually get to the render so we want to record here
+ # what the root cause was.
+ cls, value, traceback = sys.exc_info()
+ self.error.set(session, PageError(self, session,
+ cls, value, traceback))
return self.render(session)
@@ -531,15 +537,18 @@
self.url = url
class PageError(object):
- def __init__(self, page, session):
+ def __init__(self, page, session, cls, value, traceback):
self.page = page
self.session = session
+ self.cls = cls
+ self.value = value
+ self.traceback = traceback
def render(self):
writer = Writer()
writer.write("APPLICATION ERROR\n\n")
- print_exc(None, writer)
+ print_exception(self.cls, self.value, self.traceback, None, writer)
writer.write("\n")
Modified: branches/roles/wooly/python/wooly/pages.py
===================================================================
--- branches/roles/wooly/python/wooly/pages.py 2012-03-23 00:06:59 UTC (rev 5268)
+++ branches/roles/wooly/python/wooly/pages.py 2012-03-23 17:52:00 UTC (rev 5269)
@@ -105,6 +105,7 @@
self.javascript_page = JavascriptPage \
(app, self.base_name + ".js", self)
self.app.add_page(self.javascript_page)
+ self.do_authorize = True
def get_content_type(self, session):
value = session.request_environment.get("HTTP_USER_AGENT")
12 years, 1 month
r5268 - branches/roles/cumin/python/cumin
by tmckay@fedoraproject.org
Author: tmckay
Date: 2012-03-23 00:06:59 +0000 (Fri, 23 Mar 2012)
New Revision: 5268
Modified:
branches/roles/cumin/python/cumin/admin.py
branches/roles/cumin/python/cumin/widgets.py
Log:
Move the logging for getting roles for a user into admin.py
Modified: branches/roles/cumin/python/cumin/admin.py
===================================================================
--- branches/roles/cumin/python/cumin/admin.py 2012-03-22 20:32:50 UTC (rev 5267)
+++ branches/roles/cumin/python/cumin/admin.py 2012-03-23 00:06:59 UTC (rev 5268)
@@ -1,6 +1,8 @@
from StringIO import StringIO
from util import *
+from rosemary.sqlquery import SqlQuery, SqlInnerJoin
+from rosemary.sqlfilter import SqlComparisonFilter
from psycopg2 import IntegrityError, ProgrammingError
log = logging.getLogger("cumin.admin")
@@ -135,3 +137,26 @@
return mapping
+ def get_roles_for_user(self, cursor, user):
+ user_cls = self.app.model.com_redhat_cumin.User
+ role_cls = self.app.model.com_redhat_cumin.Role
+ mapping_cls = self.app.model.com_redhat_cumin.UserRoleMapping
+
+ query = SqlQuery(role_cls.sql_table)
+
+ SqlInnerJoin(query,
+ mapping_cls.sql_table,
+ mapping_cls.role.sql_column,
+ role_cls._id.sql_column)
+
+ SqlInnerJoin(query,
+ user_cls.sql_table,
+ user_cls._id.sql_column,
+ mapping_cls.user.sql_column)
+ #TODO: one column ?
+ cols = [ role_cls.name.sql_column ]
+ filt = SqlComparisonFilter(user_cls._id.sql_column, user._id, '=')
+ query.add_filter(filt)
+ sql = query.emit(cols)
+ cursor.execute(sql)
+ return [x[0] for x in cursor.fetchall()]
Modified: branches/roles/cumin/python/cumin/widgets.py
===================================================================
--- branches/roles/cumin/python/cumin/widgets.py 2012-03-22 20:32:50 UTC (rev 5267)
+++ branches/roles/cumin/python/cumin/widgets.py 2012-03-23 00:06:59 UTC (rev 5268)
@@ -1180,37 +1180,11 @@
def __init__(self, app, user):
self.app = app
self.user = user
-
- self.group = []
+
conn = self.app.database.get_connection()
cursor = conn.cursor()
- user_cls = app.model.com_redhat_cumin.User
- role_cls = app.model.com_redhat_cumin.Role
- mapping_cls = app.model.com_redhat_cumin.UserRoleMapping
+ self.group = self.app.admin.get_roles_for_user(cursor, user)
- query = SqlQuery(role_cls.sql_table)
-
- SqlInnerJoin(query,
- mapping_cls.sql_table,
- mapping_cls.role.sql_column,
- role_cls._id.sql_column)
-
- SqlInnerJoin(query,
- user_cls.sql_table,
- user_cls._id.sql_column,
- mapping_cls.user.sql_column)
- #TODO: one column ?
- cols = [ role_cls.name.sql_column ]
-
- filt = SqlComparisonFilter(user_cls._id.sql_column,user._id,'=')
- query.add_filter(filt)
- sql = query.emit(cols)
- log.debug("%s",sql)
- cursor.execute(sql)
-
- for gname in cursor.fetchall():
- self.group.append(gname[0])
-
self.created = datetime.now()
self.notifications = list()
12 years, 1 month
r5267 - branches/roles/cumin/python/cumin
by tmckay@fedoraproject.org
Author: tmckay
Date: 2012-03-22 20:32:50 +0000 (Thu, 22 Mar 2012)
New Revision: 5267
Modified:
branches/roles/cumin/python/cumin/authorize.py
Log:
Restrict the files we will consider for access maps to those ending in .xml
Modified: branches/roles/cumin/python/cumin/authorize.py
===================================================================
--- branches/roles/cumin/python/cumin/authorize.py 2012-03-22 20:18:49 UTC (rev 5266)
+++ branches/roles/cumin/python/cumin/authorize.py 2012-03-22 20:32:50 UTC (rev 5267)
@@ -84,7 +84,8 @@
log.error("Path '%s' for access files does not exist!" % access_path)
for accfile in files:
- if os.path.isfile(accfile):
+ if os.path.isfile(accfile) and \
+ os.path.splitext(accfile)[1] == ".xml":
try:
self.accmap.parse_accessfile(accfile)
except:
12 years, 1 month
r5266 - in branches/roles/cumin: . bin instance/etc metadata model model/access python/cumin
by tmckay@fedoraproject.org
Author: tmckay
Date: 2012-03-22 20:18:49 +0000 (Thu, 22 Mar 2012)
New Revision: 5266
Added:
branches/roles/cumin/model/access/
Removed:
branches/roles/cumin/metadata/access/
Modified:
branches/roles/cumin/Makefile
branches/roles/cumin/bin/cumin-web
branches/roles/cumin/instance/etc/cumin.conf
branches/roles/cumin/model/access/usergrid.xml
branches/roles/cumin/python/cumin/authorize.py
branches/roles/cumin/python/cumin/config.py
branches/roles/cumin/python/cumin/main.py
Log:
Multiple changes surrounding config and location of access mapping files.
* Removed cumin/metadata directory. This is old and hasn't been used for years. It's presence causes confusion.
* Moved standard access directory under cumin/model/access
* Fixed up make files for install, so that access dir will be installed by rpm
* Made authorize fully configurable. Default is $CUMIN_HOME/model/access/usergrid.xml. May be a single file or a directory, or "None" to turn off the feature.
* Made absence of mapping information fatal on start if the feature is on.
Modified: branches/roles/cumin/Makefile
===================================================================
--- branches/roles/cumin/Makefile 2012-03-22 19:33:54 UTC (rev 5265)
+++ branches/roles/cumin/Makefile 2012-03-22 20:18:49 UTC (rev 5266)
@@ -27,8 +27,10 @@
install -pm 0644 ../wooly/LICENSE-for-wsgiserver ${CUMIN_HOME}/doc
install -pm 0644 ../wooly/COPYING-for-wsgiserver ${CUMIN_HOME}/doc
install -d ${CUMIN_HOME}/model/upgrades
+ install -d ${CUMIN_HOME}/model/access
install -pm 0644 model/*.xml ${CUMIN_HOME}/model
- install -pm 0755 model/upgrades/* ${CUMIN_HOME}/model/upgrades/
+ install -pm 0644 model/access/* ${CUMIN_HOME}/model/access/
install -d ${CUMIN_HOME}/resources
install -pm 0644 ../wooly/resources/*.css ${CUMIN_HOME}/resources
install -pm 0644 ../wooly/resources/*.js ${CUMIN_HOME}/resources
Modified: branches/roles/cumin/bin/cumin-web
===================================================================
--- branches/roles/cumin/bin/cumin-web 2012-03-22 19:33:54 UTC (rev 5265)
+++ branches/roles/cumin/bin/cumin-web 2012-03-22 20:18:49 UTC (rev 5266)
@@ -41,7 +41,19 @@
cumin.wallaby_refresh = values.wallaby_refresh
if cumin.wallaby_refresh == 0:
cumin.wallaby_refresh = None
-
+
+def set_authorize_config(cumin, values, access_root):
+ # Allow this to be disabled via "None"
+ if values.authorize == "None":
+ cumin.access_path = None
+ else:
+ # If there is no initial dir, prepend home
+ dir_name = os.path.split(values.authorize)[0]
+ if len(dir_name) == 0:
+ cumin.access_path = os.path.join(access_root, values.authorize)
+ else:
+ cumin.access_path = values.authorize
+
def adjust_return(passed_init, ret):
# Shift non-zer0 return codes left 1 bit
# and OR in whether or not init passed
@@ -140,7 +152,8 @@
cumin.auth_create_ondemand = values.auth_create_ondemand
cumin.auth_proxy = values.auth_proxy
-
+ set_authorize_config(cumin, values, config.get_access_root())
+
cumin.debug = opts.debug
cumin.user = values.user
cumin.update_interval = values.update_interval
Modified: branches/roles/cumin/instance/etc/cumin.conf
===================================================================
--- branches/roles/cumin/instance/etc/cumin.conf 2012-03-22 19:33:54 UTC (rev 5265)
+++ branches/roles/cumin/instance/etc/cumin.conf 2012-03-22 20:18:49 UTC (rev 5266)
@@ -8,7 +8,7 @@
# host: localhost
host: 0.0.0.0
#user: guest
-authorize: usergrid.xml
+# authorize: usergrid.xml
authz-mech:
persona: default
auth-proxy: true
Modified: branches/roles/cumin/model/access/usergrid.xml
===================================================================
--- branches/roles/cumin/metadata/access/usergrid.xml 2012-03-21 20:10:53 UTC (rev 5262)
+++ branches/roles/cumin/model/access/usergrid.xml 2012-03-22 20:18:49 UTC (rev 5266)
@@ -1,9 +1,10 @@
<AccessMap>
-<GroupAccess name="nogroup">
- <WidgetAccess reg="cumin.account.widgets.LoginForm"/>
- <WidgetAccess reg="cumin.account.widgets.LoginPage"/>
- <WidgetAccess reg="cumin.account.widgets.Submit"/>
-</GroupAccess>
+ <GroupAccess name="nogroup">
+ <WidgetAccess reg="cumin.account.widgets.LoginForm"/>
+ <WidgetAccess reg="cumin.account.widgets.LoginPage"/>
+ <WidgetAccess reg="cumin.account.widgets.Submit"/>
+ <FallbackPage name="login.html"/>
+ </GroupAccess>
<GroupAccess name="user">
<SubGroupAccess name="nogroup"/>
<WidgetAccess reg="cumin.usergrid.*" />
@@ -15,9 +16,10 @@
<WidgetAccess reg="cumin.widgets.About*" />
<WidgetAccess reg="cumin.widgets.CuminFormPage" />
<WidgetAccess reg="cumin.grid.submission.*" />
-</GroupAccess>
+ <FallbackPage name="usergrid.html"/>
+ </GroupAccess>
<GroupAccess name="admin">
- <WidgetAccess reg=".*"/>
+ <WidgetAccess reg=".*"/>
</GroupAccess>
<GroupAccess name="genericadmin">
<SubGroupAccess name="user"/>
Modified: branches/roles/cumin/python/cumin/authorize.py
===================================================================
--- branches/roles/cumin/python/cumin/authorize.py 2012-03-22 19:33:54 UTC (rev 5265)
+++ branches/roles/cumin/python/cumin/authorize.py 2012-03-22 20:18:49 UTC (rev 5266)
@@ -61,23 +61,39 @@
except KeyError:
return None
+ def map_is_empty(self):
+ return len(self.mapping) == 0
+
class CuminAuthorizator(object):
- def __init__(self, app):
+ def __init__(self, app, access_path):
self.app = app
+ self.access_path = access_path
log.info("Initializing %s", self)
self.accmap = CuminAuthorizeMap()
modules = app.modules
- #TODO: this should be configurable
- access_path = app.home + "/metadata/access"
- log.debug("Access file path is %s", access_path)
- if os.path.isdir(access_path):
- for accfile in os.listdir(access_path):
- if os.path.isfile(access_path + "/" + accfile):
- self.accmap.parse_accessfile(access_path + "/" + accfile)
- else:
- log.error("Path for access files does not exist!")
- log.info("NODULES %s", modules)
+ if access_path is not None:
+ log.debug("Access file path is %s", access_path)
+ if os.path.isdir(access_path):
+ files = [os.path.join(access_path, x) \
+ for x in os.listdir(access_path)]
+ elif os.path.isfile(access_path):
+ files = [access_path]
+ else:
+ files = []
+ log.error("Path '%s' for access files does not exist!" % access_path)
+
+ for accfile in files:
+ if os.path.isfile(accfile):
+ try:
+ self.accmap.parse_accessfile(accfile)
+ except:
+ log.error("Access file '%s' does not parse!" % accfile)
+ log.info("MODULES %s", modules)
+
+ def map_is_empty(self):
+ return self.accmap.map_is_empty()
+
def find_fallback(self, web_session):
# Find a fallback page for the current login session.
# If the user is part of multiple groups, just pick the
@@ -92,6 +108,9 @@
return self.accmap.find_fallback(group)
def authorize(self,web_session, widget_name):
+ if self.access_path is None:
+ # The feature is disabled, everything is allowed
+ return True
try:
group = web_session.client_session.attributes['login_session'].group
except KeyError:
Modified: branches/roles/cumin/python/cumin/config.py
===================================================================
--- branches/roles/cumin/python/cumin/config.py 2012-03-22 19:33:54 UTC (rev 5265)
+++ branches/roles/cumin/python/cumin/config.py 2012-03-22 20:18:49 UTC (rev 5266)
@@ -65,7 +65,7 @@
param.default = False
param = ConfigParameter(web, "authorize", str)
- param.default = None
+ param.default = os.path.join(self.get_access_root(), "usergrid.xml")
param = ConfigParameter(web, "authz-provider", str)
param.default = "internal"
@@ -116,6 +116,9 @@
def get_home(self):
return self.home
+ def get_access_root(self):
+ return os.path.join(self.home, "model/access/")
+
def parse(self):
paths = list()
Modified: branches/roles/cumin/python/cumin/main.py
===================================================================
--- branches/roles/cumin/python/cumin/main.py 2012-03-22 19:33:54 UTC (rev 5265)
+++ branches/roles/cumin/python/cumin/main.py 2012-03-22 20:18:49 UTC (rev 5266)
@@ -60,9 +60,8 @@
self.modules = list()
self.modules_by_name = dict()
- self.authorizator = CuminAuthorizator(self)
- self.authorize_cb = self.authorizator.authorize
- self.fallback_cb = self.authorizator.find_fallback
+ # This is an argument to CuminAuthorizator in init()
+ self.access_path = None
self.tasks = list()
@@ -177,6 +176,16 @@
def init(self, schema_version_check=True):
log.info("Initializing %s", self)
+ # Do this initialization as late as possible so that
+ # the application can set a value for self.access_path.
+ # Alternatively, it can be an argument to the constructor.
+ self.authorizator = CuminAuthorizator(self, self.access_path)
+ if self.access_path is not None and self.authorizator.map_is_empty():
+ msg = "Access map does not exit or does not parse '%s'"
+ raise Exception(msg % self.access_path)
+
+ self.authorize_cb = self.authorizator.authorize
+ self.fallback_cb = self.authorizator.find_fallback
# Create RPC interfaces for QMF and aviary.
# These service have overlapping functionality,
12 years, 1 month
r5265 - branches/roles/cumin/bin
by vmotoska@fedoraproject.org
Author: vmotoska
Date: 2012-03-22 19:33:54 +0000 (Thu, 22 Mar 2012)
New Revision: 5265
Modified:
branches/roles/cumin/bin/cumin-admin
Log:
fix exception on add/remove assignment when invalid user/role specified
( should merge to trunk)
Modified: branches/roles/cumin/bin/cumin-admin
===================================================================
--- branches/roles/cumin/bin/cumin-admin 2012-03-22 15:02:04 UTC (rev 5264)
+++ branches/roles/cumin/bin/cumin-admin 2012-03-22 19:33:54 UTC (rev 5265)
@@ -542,7 +542,6 @@
def handle_remove_assignment(app, cursor, opts, args):
user, role = get_user_and_role(app, cursor, args)
- #TODO: check if user exists otherwise exc occures
assignment = app.admin.get_assignment(cursor, user, role)
if not assignment:
@@ -567,6 +566,11 @@
user = app.admin.get_user(cursor, user_name)
role = app.admin.get_role(cursor, role_name)
+ if not user:
+ error("Specified user %s does not exist" % user_name)
+ if not role:
+ error("Specified role %s does not exist" % role_name)
+
return user, role
def handle_change_password(app, cursor, opts, args):
12 years, 1 month
##cumin on irc.freenode.net
by Trevor McKay
Hi,
I've added a permanent IRC channel on freenode, ##cumin. I thought
this would be helpful for realtime discussions of development, usage,
etc.
This is the first channel I've set up, so we may have to tweak things
as we go. I'll plan to hang out there daily.
Best,
Trev
12 years, 1 month
r5264 - trunk/cumin
by croberts@fedoraproject.org
Author: croberts
Date: 2012-03-22 15:02:04 +0000 (Thu, 22 Mar 2012)
New Revision: 5264
Removed:
trunk/cumin/flash-slots/
Log:
Removing the flash code that was used for the slotvis.
12 years, 1 month