X-Git-Url: https://osm.etsi.org/gitweb/?p=osm%2FNBI.git;a=blobdiff_plain;f=osm_nbi%2Fauth.py;h=9098de7835a1c93c521a2d87e888532311b2ead5;hp=c320d50f295fd28af990229c4fe4c3015dcc2c25;hb=d7749588e6cc73661d052fc5bb41605e1b588128;hpb=e1eb3b2c0bdb7462d330703702677b3354ceb9ff diff --git a/osm_nbi/auth.py b/osm_nbi/auth.py index c320d50..9098de7 100644 --- a/osm_nbi/auth.py +++ b/osm_nbi/auth.py @@ -39,14 +39,13 @@ from http import HTTPStatus from time import time from os import path -from authconn import AuthException, AuthExceptionUnauthorized -from authconn_keystone import AuthconnKeystone -from authconn_internal import AuthconnInternal # Comment out for testing&debugging, uncomment when ready -from osm_common import dbmongo -from osm_common import dbmemory +from osm_nbi.authconn import AuthException, AuthExceptionUnauthorized +from osm_nbi.authconn_keystone import AuthconnKeystone +from osm_nbi.authconn_internal import AuthconnInternal +from osm_common import dbmemory, dbmongo, msglocal, msgkafka from osm_common.dbbase import DbException +from osm_nbi.validation import is_valid_uuid from itertools import chain - from uuid import uuid4 @@ -60,6 +59,7 @@ class Authenticator: """ periodin_db_pruning = 60 * 30 # for the internal backend only. every 30 minutes expired tokens will be pruned + token_limit = 500 # when reached, the token cache will be cleared def __init__(self, valid_methods, valid_query_string): """ @@ -69,6 +69,7 @@ class Authenticator: self.backend = None self.config = None self.db = None + self.msg = None self.tokens_cache = dict() self.next_db_prune_time = 0 # time when next cleaning of expired tokens must be done self.roles_to_operations_file = None @@ -101,11 +102,21 @@ class Authenticator: else: raise AuthException("Invalid configuration param '{}' at '[database]':'driver'" .format(config["database"]["driver"])) + if not self.msg: + if config["message"]["driver"] == "local": + self.msg = msglocal.MsgLocal() + self.msg.connect(config["message"]) + elif config["message"]["driver"] == "kafka": + self.msg = msgkafka.MsgKafka() + self.msg.connect(config["message"]) + else: + raise AuthException("Invalid configuration param '{}' at '[message]':'driver'" + .format(config["message"]["driver"])) if not self.backend: if config["authentication"]["backend"] == "keystone": - self.backend = AuthconnKeystone(self.config["authentication"], self.db, self.tokens_cache) + self.backend = AuthconnKeystone(self.config["authentication"], self.db, self.role_permissions) elif config["authentication"]["backend"] == "internal": - self.backend = AuthconnInternal(self.config["authentication"], self.db, self.tokens_cache) + self.backend = AuthconnInternal(self.config["authentication"], self.db, self.role_permissions) self._internal_tokens_prune() else: raise AuthException("Unknown authentication backend: {}" @@ -214,7 +225,7 @@ class Authenticator: # Loading permissions to MongoDB if there is not any permission. if not records or (len(records) == 1 and records[0]["name"] == "admin"): with open(self.roles_to_operations_file, "r") as stream: - roles_to_operations_yaml = yaml.load(stream) + roles_to_operations_yaml = yaml.load(stream, Loader=yaml.Loader) role_names = [] for role_with_operations in roles_to_operations_yaml["roles"]: @@ -257,15 +268,33 @@ class Authenticator: # Create admin project&user if required pid = self.create_admin_project() - self.create_admin_user(pid) + user_id = self.create_admin_user(pid) - # self.backend.update_user({"_id": "admin", - # "add_project_role_mappings": {"project": "admin", "role": "system_admin"}}) - if self.config["authentication"]["backend"] == "keystone": + # try to assign system_admin role to user admin if not any user has this role + if not user_id: try: - self.backend.assign_role_to_user("admin", "admin", "system_admin") - except Exception: - pass + users = self.backend.get_user_list() + roles = self.backend.get_role_list({"name": "system_admin"}) + role_id = roles[0]["_id"] + user_with_system_admin = False + user_admin_id = None + for user in users: + if not user_admin_id: + user_admin_id = user["_id"] + if user["username"] == "admin": + user_admin_id = user["_id"] + for prm in user.get("project_role_mappings", ()): + if prm["role"] == role_id: + user_with_system_admin = True + break + if user_with_system_admin: + break + if not user_with_system_admin: + self.backend.update_user({"_id": user_admin_id, + "add_project_role_mappings": [{"project": pid, "role": role_id}]}) + self.logger.info("Added role system admin to user='{}' project=admin".format(user_admin_id)) + except Exception as e: + self.logger.error("Error in Authorization DataBase initialization: {}: {}".format(type(e).__name__, e)) self.load_operation_to_allowed_roles() @@ -302,7 +331,7 @@ class Authenticator: self.operation_to_allowed_roles = permissions - def authorize(self, role_permission=None, query_string_operations=None): + def authorize(self, role_permission=None, query_string_operations=None, item_id=None): token = None user_passwd64 = None try: @@ -336,12 +365,29 @@ class Authenticator: if not token: raise AuthException("Needed a token or Authorization http header", http_code=HTTPStatus.UNAUTHORIZED) - token_info = self.backend.validate_token(token) + + # try to get from cache first + now = time() + token_info = self.tokens_cache.get(token) + if token_info and token_info["expires"] < now: + # delete token. MUST be done with care, as another thread maybe already delete it. Do not use del + self.tokens_cache.pop(token, None) + token_info = None + + # get from database if not in cache + if not token_info: + token_info = self.backend.validate_token(token) + # Clear cache if token limit reached + if len(self.tokens_cache) > self.token_limit: + self.tokens_cache.clear() + self.tokens_cache[token] = token_info # TODO add to token info remote host, port if role_permission: - self.check_permissions(token_info, cherrypy.request.method, role_permission, - query_string_operations) + RBAC_auth = self.check_permissions(token_info, cherrypy.request.method, role_permission, + query_string_operations, item_id) + token_info["allow_show_user_project_role"] = RBAC_auth + return token_info except AuthException as e: if not isinstance(e, AuthExceptionUnauthorized): @@ -358,10 +404,8 @@ class Authenticator: def new_token(self, token_info, indata, remote): new_token_info = self.backend.authenticate( - user=indata.get("username"), - password=indata.get("password"), + credentials=indata, token_info=token_info, - project=indata.get("project_id") ) new_token_info["remote_port"] = remote.port @@ -376,8 +420,6 @@ class Authenticator: elif remote.ip: new_token_info["remote_host"] = remote.ip - self.tokens_cache[new_token_info["_id"]] = new_token_info - # TODO call self._internal_tokens_prune(now) ? return deepcopy(new_token_info) @@ -404,12 +446,13 @@ class Authenticator: def del_token(self, token): try: self.backend.revoke_token(token) - self.tokens_cache.pop(token, None) + # self.tokens_cache.pop(token, None) + self.remove_token_from_cache(token) return "token '{}' deleted".format(token) except KeyError: raise AuthException("Token '{}' not found".format(token), http_code=HTTPStatus.NOT_FOUND) - def check_permissions(self, token_info, method, role_permission=None, query_string_operations=None): + def check_permissions(self, token_info, method, role_permission=None, query_string_operations=None, item_id=None): """ Checks that operation has permissions to be done, base on the assigned roles to this user project :param token_info: Dictionary that contains "roles" with a list of assigned roles. @@ -419,7 +462,9 @@ class Authenticator: :param role_permission: role permission name of the operation required :param query_string_operations: list of possible admin query strings provided by user. It is checked that the assigned role allows this query string for this method - :return: None if granted, exception if not allowed + :param item_id: item identifier if included in the URL, None otherwise + :return: True if access granted by permission rules, False if access granted by default rules (Bug 853) + :raises: AuthExceptionUnauthorized if access denied """ roles_required = self.operation_to_allowed_roles[role_permission] @@ -433,19 +478,29 @@ class Authenticator: break if "anonymous" in roles_required: - return + return True operation_allowed = False for role in roles_allowed: if role in roles_required: operation_allowed = True # if query_string operations, check if this role allows it if not query_string_operations: - return + return True for query_string_operation in query_string_operations: if role not in self.operation_to_allowed_roles[query_string_operation]: break else: - return + return True + + # Bug 853 - Final Solution + # User/Project/Role whole listings are filtered elsewhere + # uid, pid, rid = ("user_id", "project_id", "id") if is_valid_uuid(id) else ("username", "project_name", "name") + uid = "user_id" if is_valid_uuid(item_id) else "username" + if (role_permission in ["projects:get", "projects:id:get", "roles:get", "roles:id:get", "users:get"]) \ + or (role_permission == "users:id:get" and item_id == token_info[uid]): + # or (role_permission == "projects:id:get" and item_id == token_info[pid]) \ + # or (role_permission == "roles:id:get" and item_id in [role[rid] for role in token_info["roles"]]): + return False if not operation_allowed: raise AuthExceptionUnauthorized("Access denied: lack of permissions.") @@ -525,4 +580,11 @@ class Authenticator: if not self.next_db_prune_time or self.next_db_prune_time >= now: self.db.del_list("tokens", {"expires.lt": now}) self.next_db_prune_time = self.periodin_db_pruning + now - self.tokens_cache.clear() # force to reload tokens from database + # self.tokens_cache.clear() # not required any more + + def remove_token_from_cache(self, token=None): + if token: + self.tokens_cache.pop(token, None) + else: + self.tokens_cache.clear() + self.msg.write("admin", "revoke_token", {"_id": token} if token else None)