XRootD
XrdSciTokensAccess.cc File Reference
#include "XrdAcc/XrdAccAuthorize.hh"
#include "XrdOuc/XrdOucEnv.hh"
#include "XrdOuc/XrdOucGatherConf.hh"
#include "XrdSec/XrdSecEntity.hh"
#include "XrdSec/XrdSecEntityAttr.hh"
#include "XrdSys/XrdSysLogger.hh"
#include "XrdTls/XrdTlsContext.hh"
#include "XrdVersion.hh"
#include <map>
#include <memory>
#include <mutex>
#include <string>
#include <vector>
#include <sstream>
#include <fstream>
#include <unordered_map>
#include <tuple>
#include "fcntl.h"
#include "INIReader.h"
#include "picojson.h"
#include "scitokens/scitokens.h"
#include "XrdSciTokens/XrdSciTokensAccess.hh"
#include "XrdSciTokens/XrdSciTokensHelper.hh"
#include "XrdSciTokens/XrdSciTokensMon.hh"
+ Include dependency graph for XrdSciTokensAccess.cc:

Go to the source code of this file.

Classes

class  XrdAccSciTokens
 

Functions

bool AuthorizesRequiredIssuers (Access_Operation client_oper, const std::string_view &path, const std::vector< std::pair< std::unique_ptr< SubpathMatch >, std::string >> &required_issuers, const std::vector< std::shared_ptr< XrdAccRules >> &access_rules_list)
 
void InitAccSciTokens (XrdSysLogger *lp, const char *cfn, const char *parm, XrdAccAuthorize *accP, XrdOucEnv *envP)
 
XrdAccAuthorizeXrdAccAuthorizeObjAdd (XrdSysLogger *lp, const char *cfn, const char *parm, XrdOucEnv *envP, XrdAccAuthorize *accP)
 
XrdAccAuthorizeXrdAccAuthorizeObject (XrdSysLogger *lp, const char *cfn, const char *parm)
 
XrdAccAuthorizeXrdAccAuthorizeObject2 (XrdSysLogger *lp, const char *cfn, const char *parm, XrdOucEnv *envP)
 
 XrdVERSIONINFO (XrdAccAuthorizeObjAdd, XrdAccSciTokens)
 
 XrdVERSIONINFO (XrdAccAuthorizeObject, XrdAccSciTokens)
 

Variables

XrdAccSciTokensaccSciTokens = nullptr
 
XrdSciTokensHelperSciTokensHelper = nullptr
 

Function Documentation

◆ AuthorizesRequiredIssuers()

bool AuthorizesRequiredIssuers ( Access_Operation  client_oper,
const std::string_view &  path,
const std::vector< std::pair< std::unique_ptr< SubpathMatch >, std::string >> &  required_issuers,
const std::vector< std::shared_ptr< XrdAccRules >> &  access_rules_list 
)

Definition at line 369 of file XrdSciTokensAccess.cc.

372 {
373 
374  // Translate the client-attempted operation to one of the simpler operations we've defined.
375  Access_Operation oper;
376  switch (client_oper) {
377  case AOP_Any:
378  return false; // Invalid request
379  break;
380  case AOP_Chmod: [[fallthrough]];
381  case AOP_Chown: [[fallthrough]];
382  case AOP_Create: [[fallthrough]];
383  case AOP_Excl_Create: [[fallthrough]];
384  case AOP_Delete: [[fallthrough]];
385  case AOP_Excl_Insert: [[fallthrough]];
386  case AOP_Insert: [[fallthrough]];
387  case AOP_Lock:
388  oper = AOP_Create;
389  break;
390  case AOP_Mkdir:
391  oper = AOP_Mkdir;
392  break;
393  case AOP_Read:
394  oper = AOP_Read;
395  break;
396  case AOP_Readdir:
397  oper = AOP_Readdir;
398  break;
399  case AOP_Rename:
400  oper = AOP_Create;
401  break;
402  case AOP_Stat:
403  oper = AOP_Stat;
404  break;
405  case AOP_Update:
406  oper = AOP_Update;
407  break;
408  default:
409  return false; // Invalid request
410  };
411 
412  // Iterate through all the required issuers
413  for (const auto &info : required_issuers) {
414  // See if this issuer is required for this path/operation.
415  if (info.first->apply(oper, path)) {
416  bool has_authz = false;
417  // If so, see if one of the tokens (a) is from this issuer and (b) authorizes the request.
418  for (const auto &rules : access_rules_list) {
419  if (rules->get_issuer() == info.second && rules->apply(oper, path)) {
420  has_authz = true;
421  break;
422  }
423  }
424  if (!has_authz) {
425  return false;
426  }
427  }
428  }
429  return true;
430 }
Access_Operation
The following are supported operations.
@ AOP_Delete
rm() or rmdir()
@ AOP_Mkdir
mkdir()
@ AOP_Update
open() r/w or append
@ AOP_Create
open() with create
@ AOP_Readdir
opendir()
@ AOP_Chmod
chmod()
@ AOP_Any
Special for getting privs.
@ AOP_Stat
exists(), stat()
@ AOP_Rename
mv() for source
@ AOP_Read
open() r/o, prepare()
@ AOP_Excl_Create
open() with O_EXCL|O_CREAT
@ AOP_Insert
mv() for target
@ AOP_Lock
n/a
@ AOP_Chown
chown()
@ AOP_Excl_Insert
mv() where destination doesn't exist.

References AOP_Any, AOP_Chmod, AOP_Chown, AOP_Create, AOP_Delete, AOP_Excl_Create, AOP_Excl_Insert, AOP_Insert, AOP_Lock, AOP_Mkdir, AOP_Read, AOP_Readdir, AOP_Rename, AOP_Stat, and AOP_Update.

Referenced by XrdAccSciTokens::Access().

+ Here is the caller graph for this function:

◆ InitAccSciTokens()

void InitAccSciTokens ( XrdSysLogger lp,
const char *  cfn,
const char *  parm,
XrdAccAuthorize accP,
XrdOucEnv envP 
)

Definition at line 1441 of file XrdSciTokensAccess.cc.

1443 {
1444  try {
1445  accSciTokens = new XrdAccSciTokens(lp, parm, accP, envP);
1447  } catch (std::exception &) {
1448  }
1449 }
XrdAccSciTokens * accSciTokens
XrdSciTokensHelper * SciTokensHelper
XrdOucEnv * envP
Definition: XrdPss.cc:109

References accSciTokens, XrdProxy::envP, and SciTokensHelper.

Referenced by XrdAccAuthorizeObjAdd(), XrdAccAuthorizeObject(), and XrdAccAuthorizeObject2().

+ Here is the caller graph for this function:

◆ XrdAccAuthorizeObjAdd()

XrdAccAuthorize* XrdAccAuthorizeObjAdd ( XrdSysLogger lp,
const char *  cfn,
const char *  parm,
XrdOucEnv envP,
XrdAccAuthorize accP 
)

Definition at line 1453 of file XrdSciTokensAccess.cc.

1458 {
1459  // Record the parent authorization plugin. There is no need to use
1460  // unique_ptr as all of this happens once in the main and only thread.
1461  //
1462 
1463  // If we have been initialized by a previous load, them return that result.
1464  // Otherwise, it's the first time through, get a new SciTokens authorizer.
1465  //
1466  if (!accSciTokens) InitAccSciTokens(lp, cfn, parm, accP, envP);
1467  return accSciTokens;
1468 }
void InitAccSciTokens(XrdSysLogger *lp, const char *cfn, const char *parm, XrdAccAuthorize *accP, XrdOucEnv *envP)

References accSciTokens, XrdProxy::envP, and InitAccSciTokens().

+ Here is the call graph for this function:

◆ XrdAccAuthorizeObject()

XrdAccAuthorize* XrdAccAuthorizeObject ( XrdSysLogger lp,
const char *  cfn,
const char *  parm 
)

Definition at line 1470 of file XrdSciTokensAccess.cc.

1473 {
1474  InitAccSciTokens(lp, cfn, parm, nullptr, nullptr);
1475  return accSciTokens;
1476 }

References accSciTokens, and InitAccSciTokens().

+ Here is the call graph for this function:

◆ XrdAccAuthorizeObject2()

XrdAccAuthorize* XrdAccAuthorizeObject2 ( XrdSysLogger lp,
const char *  cfn,
const char *  parm,
XrdOucEnv envP 
)

Definition at line 1478 of file XrdSciTokensAccess.cc.

1482 {
1483  InitAccSciTokens(lp, cfn, parm, nullptr, envP);
1484  return accSciTokens;
1485 }

References accSciTokens, XrdProxy::envP, and InitAccSciTokens().

+ Here is the call graph for this function:

◆ XrdVERSIONINFO() [1/2]

XrdVERSIONINFO ( XrdAccAuthorizeObjAdd  ,
XrdAccSciTokens   
)

◆ XrdVERSIONINFO() [2/2]

XrdVERSIONINFO ( XrdAccAuthorizeObject  ,
XrdAccSciTokens   
)

Variable Documentation

◆ accSciTokens

◆ SciTokensHelper

XrdSciTokensHelper* SciTokensHelper = nullptr

Definition at line 36 of file XrdSciTokensAccess.cc.

Referenced by InitAccSciTokens().