From: tierno Date: Mon, 23 Mar 2020 09:24:10 +0000 (+0000) Subject: bug 1035. Load role permissions from nbi.py 'valid_url_methods' instead of 'resources... X-Git-Tag: v7.1.0rc1~16 X-Git-Url: https://osm.etsi.org/gitweb/?a=commitdiff_plain;h=9e87a7fbc49d98dfae5fc6b7f4c17b81729a2af7;p=osm%2FNBI.git bug 1035. Load role permissions from nbi.py 'valid_url_methods' instead of 'resources_to_operations.yml' Change-Id: I84a80f8cef886cbce9b22819ead04ae14d31af79 Signed-off-by: tierno --- diff --git a/devops-stages/stage-test.sh b/devops-stages/stage-test.sh index 71d2252..87802ea 100755 --- a/devops-stages/stage-test.sh +++ b/devops-stages/stage-test.sh @@ -13,5 +13,6 @@ # See the License for the specific language governing permissions and # limitations under the License. +rm -f nosetests.xml tox # flake8 unittest diff --git a/osm_nbi/admin_topics.py b/osm_nbi/admin_topics.py index 565d763..9f591fc 100644 --- a/osm_nbi/admin_topics.py +++ b/osm_nbi/admin_topics.py @@ -1027,10 +1027,10 @@ class RoleTopicAuth(BaseTopic): schema_edit = roles_edit_schema multiproject = False - def __init__(self, db, fs, msg, auth, ops): + def __init__(self, db, fs, msg, auth): BaseTopic.__init__(self, db, fs, msg, auth) # self.auth = auth - self.operations = ops + self.operations = auth.role_permissions # self.topic = "roles_operations" if isinstance(auth, AuthconnKeystone) else "roles" @staticmethod diff --git a/osm_nbi/auth.py b/osm_nbi/auth.py index f756d9d..9098de7 100644 --- a/osm_nbi/auth.py +++ b/osm_nbi/auth.py @@ -114,9 +114,9 @@ class Authenticator: .format(config["message"]["driver"])) if not self.backend: if config["authentication"]["backend"] == "keystone": - self.backend = AuthconnKeystone(self.config["authentication"], self.db) + self.backend = AuthconnKeystone(self.config["authentication"], self.db, self.role_permissions) elif config["authentication"]["backend"] == "internal": - self.backend = AuthconnInternal(self.config["authentication"], self.db) + self.backend = AuthconnInternal(self.config["authentication"], self.db, self.role_permissions) self._internal_tokens_prune() else: raise AuthException("Unknown authentication backend: {}" diff --git a/osm_nbi/authconn.py b/osm_nbi/authconn.py index c43c339..bbcf342 100644 --- a/osm_nbi/authconn.py +++ b/osm_nbi/authconn.py @@ -110,16 +110,16 @@ class Authconn: Each Auth backend connector plugin must be a subclass of Authconn class. """ - def __init__(self, config, db): + def __init__(self, config, db, role_permissions): """ Constructor of the Authconn class. - - Note: each subclass - :param config: configuration dictionary containing all the necessary configuration parameters. + :param db: internal database classs + :param role_permissions: read only role permission list """ self.config = config + self.role_permissions = role_permissions def authenticate(self, credentials, token_info=None): """ diff --git a/osm_nbi/authconn_internal.py b/osm_nbi/authconn_internal.py index 1977aca..88b276d 100644 --- a/osm_nbi/authconn_internal.py +++ b/osm_nbi/authconn_internal.py @@ -46,8 +46,8 @@ class AuthconnInternal(Authconn): token_time_window = 2 # seconds token_delay = 1 # seconds to wait upon second request within time window - def __init__(self, config, db): - Authconn.__init__(self, config, db) + def __init__(self, config, db, role_permissions): + Authconn.__init__(self, config, db, role_permissions) self.logger = logging.getLogger("nbi.authenticator.internal") self.db = db diff --git a/osm_nbi/authconn_keystone.py b/osm_nbi/authconn_keystone.py index c69d64b..d71408a 100644 --- a/osm_nbi/authconn_keystone.py +++ b/osm_nbi/authconn_keystone.py @@ -45,8 +45,8 @@ from osm_nbi.validation import is_valid_uuid class AuthconnKeystone(Authconn): - def __init__(self, config, db): - Authconn.__init__(self, config, db) + def __init__(self, config, db, role_permissions): + Authconn.__init__(self, config, db, role_permissions) self.logger = logging.getLogger("nbi.authenticator.keystone") self.domains_id2name = {} diff --git a/osm_nbi/engine.py b/osm_nbi/engine.py index cd02b1d..34f0f14 100644 --- a/osm_nbi/engine.py +++ b/osm_nbi/engine.py @@ -14,7 +14,7 @@ # limitations under the License. import logging -import yaml +# import yaml from osm_common import dbmongo, dbmemory, fslocal, fsmongo, msglocal, msgkafka, version as common_version from osm_common.dbbase import DbException from osm_common.fsbase import FsException @@ -31,7 +31,7 @@ from osm_nbi.descriptor_topics import VnfdTopic, NsdTopic, PduTopic, NstTopic, V from osm_nbi.instance_topics import NsrTopic, VnfrTopic, NsLcmOpTopic, NsiTopic, NsiLcmOpTopic from osm_nbi.pmjobs_topics import PmJobsTopic from base64 import b64encode -from os import urandom, path +from os import urandom # , path from threading import Lock __author__ = "Alfonso Tierno " @@ -75,7 +75,7 @@ class Engine(object): self.msg = None self.authconn = None self.config = None - self.operations = None + # self.operations = None self.logger = logging.getLogger("nbi.engine") self.map_topic = {} self.write_lock = None @@ -127,43 +127,42 @@ class Engine(object): config["message"]["driver"])) if not self.authconn: if config["authentication"]["backend"] == "keystone": - self.authconn = AuthconnKeystone(config["authentication"], self.db) + self.authconn = AuthconnKeystone(config["authentication"], self.db, + self.authenticator.role_permissions) else: - self.authconn = AuthconnInternal(config["authentication"], self.db) - if not self.operations: - if "resources_to_operations" in config["rbac"]: - resources_to_operations_file = config["rbac"]["resources_to_operations"] - else: - possible_paths = ( - __file__[:__file__.rfind("engine.py")] + "resources_to_operations.yml", - "./resources_to_operations.yml" - ) - for config_file in possible_paths: - if path.isfile(config_file): - resources_to_operations_file = config_file - break - if not resources_to_operations_file: - raise EngineException("Invalid permission configuration: resources_to_operations file missing") - - with open(resources_to_operations_file, 'r') as f: - resources_to_operations = yaml.load(f, Loader=yaml.Loader) - - self.operations = [] - - for _, value in resources_to_operations["resources_to_operations"].items(): - if value not in self.operations: - self.operations += [value] + self.authconn = AuthconnInternal(config["authentication"], self.db, + self.authenticator.role_permissions) + # if not self.operations: + # if "resources_to_operations" in config["rbac"]: + # resources_to_operations_file = config["rbac"]["resources_to_operations"] + # else: + # possible_paths = ( + # __file__[:__file__.rfind("engine.py")] + "resources_to_operations.yml", + # "./resources_to_operations.yml" + # ) + # for config_file in possible_paths: + # if path.isfile(config_file): + # resources_to_operations_file = config_file + # break + # if not resources_to_operations_file: + # raise EngineException("Invalid permission configuration:" + # "resources_to_operations file missing") + # + # with open(resources_to_operations_file, 'r') as f: + # resources_to_operations = yaml.load(f, Loader=yaml.Loader) + # + # self.operations = [] + # + # for _, value in resources_to_operations["resources_to_operations"].items(): + # if value not in self.operations: + # self.operations += [value] self.write_lock = Lock() # create one class per topic for topic, topic_class in self.map_from_topic_to_class.items(): # if self.auth and topic_class in (UserTopicAuth, ProjectTopicAuth): # self.map_topic[topic] = topic_class(self.db, self.fs, self.msg, self.auth) - if self.authconn and topic_class == RoleTopicAuth: - self.map_topic[topic] = topic_class(self.db, self.fs, self.msg, self.authconn, - self.operations) - else: - self.map_topic[topic] = topic_class(self.db, self.fs, self.msg, self.authconn) + self.map_topic[topic] = topic_class(self.db, self.fs, self.msg, self.authconn) self.map_topic["pm_jobs"] = PmJobsTopic(self.db, config["prometheus"].get("host"), config["prometheus"].get("port")) diff --git a/osm_nbi/tests/test_admin_topics.py b/osm_nbi/tests/test_admin_topics.py index a28953b..596faeb 100755 --- a/osm_nbi/tests/test_admin_topics.py +++ b/osm_nbi/tests/test_admin_topics.py @@ -50,7 +50,7 @@ class Test_ProjectTopicAuth(TestCase): self.db = Mock(dbbase.DbBase()) self.fs = Mock(fsbase.FsBase()) self.msg = Mock(msgbase.MsgBase()) - self.auth = Mock(authconn.Authconn(None, None)) + self.auth = Mock(authconn.Authconn(None, None, None)) self.topic = ProjectTopicAuth(self.db, self.fs, self.msg, self.auth) self.fake_session = {"username": self.test_name, "project_id": (test_pid,), "method": None, "admin": True, "force": False, "public": False, "allow_show_user_project_role": True} @@ -210,8 +210,9 @@ class Test_RoleTopicAuth(TestCase): self.db = Mock(dbbase.DbBase()) self.fs = Mock(fsbase.FsBase()) self.msg = Mock(msgbase.MsgBase()) - self.auth = Mock(authconn.Authconn(None, None)) - self.topic = RoleTopicAuth(self.db, self.fs, self.msg, self.auth, self.test_operations) + self.auth = Mock(authconn.Authconn(None, None, None)) + self.auth.role_permissions = self.test_operations + self.topic = RoleTopicAuth(self.db, self.fs, self.msg, self.auth) self.fake_session = {"username": test_name, "project_id": (test_pid,), "method": None, "admin": True, "force": False, "public": False, "allow_show_user_project_role": True} @@ -370,7 +371,7 @@ class Test_UserTopicAuth(TestCase): self.db = Mock(dbbase.DbBase()) self.fs = Mock(fsbase.FsBase()) self.msg = Mock(msgbase.MsgBase()) - self.auth = Mock(authconn.Authconn(None, None)) + self.auth = Mock(authconn.Authconn(None, None, None)) self.topic = UserTopicAuth(self.db, self.fs, self.msg, self.auth) self.fake_session = {"username": test_name, "project_id": (test_pid,), "method": None, "admin": True, "force": False, "public": False, "allow_show_user_project_role": True} @@ -588,7 +589,7 @@ class Test_CommonVimWimSdn(TestCase): self.db = Mock(dbbase.DbBase()) self.fs = Mock(fsbase.FsBase()) self.msg = Mock(msgbase.MsgBase()) - self.auth = Mock(authconn.Authconn(None, None)) + self.auth = Mock(authconn.Authconn(None, None, None)) self.topic = CommonVimWimSdn(self.db, self.fs, self.msg, self.auth) # Use WIM schemas for testing because they are the simplest self.topic.topic = "wims" diff --git a/osm_nbi/tests/test_descriptor_topics.py b/osm_nbi/tests/test_descriptor_topics.py index 6e39030..773131c 100755 --- a/osm_nbi/tests/test_descriptor_topics.py +++ b/osm_nbi/tests/test_descriptor_topics.py @@ -84,7 +84,7 @@ class Test_VnfdTopic(TestCase): self.db = Mock(dbbase.DbBase()) self.fs = Mock(fsbase.FsBase()) self.msg = Mock(msgbase.MsgBase()) - self.auth = Mock(authconn.Authconn(None, None)) + self.auth = Mock(authconn.Authconn(None, None, None)) self.topic = VnfdTopic(self.db, self.fs, self.msg, self.auth) def test_new_vnfd(self): @@ -512,7 +512,7 @@ class Test_NsdTopic(TestCase): self.db = Mock(dbbase.DbBase()) self.fs = Mock(fsbase.FsBase()) self.msg = Mock(msgbase.MsgBase()) - self.auth = Mock(authconn.Authconn(None, None)) + self.auth = Mock(authconn.Authconn(None, None, None)) self.topic = NsdTopic(self.db, self.fs, self.msg, self.auth) def test_new_nsd(self):