source: trunk/packages/invirt-web/code/getafsgroups.py @ 2574

Last change on this file since 2574 was 2557, checked in by broder, 15 years ago

Re-arrange the authz configuration.

In particular, even if we allow for mixing of multiple authz
mechanisms at some point, you won't have multiple instances of the
locker authz type, so the "type" shouldn't be a property of each of
the cells we specify how to authenticate against.

  • Property svn:executable set to *
File size: 4.0 KB
Line 
1#!/usr/bin/python
2import pprint
3import subprocess
4from invirt.config import structs as config
5
6# import ldap
7# l = ldap.open("W92-130-LDAP-2.mit.edu")
8# # ldap.mit.edu is 1/2 broken right now so we're going to the working backend
9# l.simple_bind_s("", "")
10
11# def getLdapGroups(user):
12#     """
13#     getLdapGroups(user): returns a generator for the list of LDAP groups containing user
14#     """
15#     for user_data in l.search_s("ou=affiliates,dc=mit,dc=edu", ldap.SCOPE_ONELEVEL, "uid=" + user, []):
16#         for group_data in l.search_s("ou=groups,dc=mit,dc=edu", ldap.SCOPE_ONELEVEL, "uniqueMember="+user_data[0], ['cn']):
17#             yield group_data[1]['cn'][0]
18
19# def checkLdapGroups(user, group):
20#     """
21#     checkLdapGroups(user, group): returns True if and only if user is in LDAP group group
22#     """
23#     for result_data in l.search_s("ou=affiliates,dc=mit,dc=edu", ldap.SCOPE_ONELEVEL, "uid=" + user, []):
24#         if l.search_s("ou=groups,dc=mit,dc=edu", ldap.SCOPE_ONELEVEL, "(&(cn=" + group + ")(uniqueMember="+result_data[0] + "))", []) != []:
25#             return True
26#     return False
27
28class AfsProcessError(Exception):
29    pass
30
31def getAfsGroupMembers(group, cell):
32    encrypt = True
33    for c in config.authz.cells:
34        if c.cell == cell and hasattr(c, 'auth'):
35            encrypt = c.auth
36    subprocess.check_call(['aklog', cell], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
37    p = subprocess.Popen(["pts", "membership", "-encrypt" if encrypt else '-noauth', group, '-c', cell],
38                         stdout=subprocess.PIPE, stderr=subprocess.PIPE)
39    err = p.stderr.read()
40    if err: #Error code doesn't reveal missing groups, but stderr does
41        if err.startswith('pts: Permission denied ; unable to get membership of '):
42            return []
43        raise AfsProcessError(err)
44    return [line.strip() for line in p.stdout.readlines()[1:]]
45
46def getLockerPath(locker):
47    if '/' in locker or locker in ['.', '..']:
48        raise AfsProcessError("Locker '%s' is invalid." % locker)
49    return '/mit/' + locker
50
51def getCell(locker):
52    p = subprocess.Popen(["fs", "whichcell", getLockerPath(locker)], 
53                         stdout=subprocess.PIPE, stderr=subprocess.PIPE)
54    if p.wait():
55        raise AfsProcessError(p.stderr.read())
56    return p.stdout.read().split()[-1][1:-1]
57
58def getLockerAcl(locker):
59    p = subprocess.Popen(["fs", "listacl", getLockerPath(locker)], 
60                         stdout=subprocess.PIPE, stderr=subprocess.PIPE)
61    if p.wait():
62        raise AfsProcessError(p.stderr.read())
63    lines = p.stdout.readlines()
64    values = []
65    for line in lines[1:]:
66        fields = line.split()
67        if fields[0] == 'Negative':
68            break
69        if 'a' in fields[1]:
70            values.append(fields[0])
71    return values
72
73def notLockerOwner(user, locker):
74    """
75    notLockerOwner(user, locker) returns false if and only if user administers locker.
76
77    If the user does not own the locker, returns the string reason for
78    the failure.
79    """
80    try:
81        cell = getCell(locker)
82        values = getLockerAcl(locker)
83    except AfsProcessError, e:
84        return str(e)
85
86    for entry in values:
87        if entry == user or (entry[0:6] == "system" and
88                                user in getAfsGroupMembers(entry, cell)):
89            return False
90    return "You don't have admin bits on " + getLockerPath(locker)
91
92
93if __name__ == "__main__":
94#    print list(getldapgroups("tabbott"))
95    print "tabbott" in getAfsGroupMembers("system:debathena", 'athena.mit.edu')
96    print "tabbott" in getAfsGroupMembers("system:debathena", 'sipb.mit.edu')
97    print "tabbott" in getAfsGroupMembers("system:debathena-root", 'athena.mit.edu')
98    print "tabbott" in getAfsGroupMembers("system:hmmt-request", 'athena.mit.edu')
99    print notLockerOwner("tabbott", "tabbott")
100    print notLockerOwner("tabbott", "debathena")
101    print notLockerOwner("tabbott", "sipb")
102    print notLockerOwner("tabbott", "lsc")
103    print notLockerOwner("tabbott", "scripts")
104    print notLockerOwner("ecprice", "hmmt")
Note: See TracBrowser for help on using the repository browser.