XrdSciTokensAccess.hh File Reference

#include "XrdAcc/XrdAccAuthorize.hh"
#include "XrdOuc/XrdOucPrivateUtils.hh"
#include <memory>
#include <string>
#include <string_view>
#include <vector>
#include <string.h>

Include dependency graph for XrdSciTokensAccess.hh:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
struct	MapRule
class	SubpathMatch
class	XrdAccRules

Typedefs
typedef std::vector< std::pair< Access_Operation, std::string > >	AccessRulesRaw

Enumerations
enum class	AuthzSetting {   None ,   Read ,   Write ,   All }
enum	IssuerAuthz {   Capability = 0x01 ,   Group = 0x02 ,   Mapping = 0x04 ,   Default = 0x07 }

Functions
bool	AuthorizesRequiredIssuers (Access_Operation client_oper, const std::string_view &path, const std::vector< std::pair< std::unique_ptr< SubpathMatch >, std::string > > &required_issuers, const std::vector< std::shared_ptr< XrdAccRules > > &access_rules_list)

Typedef Documentation

AccessRulesRaw

typedef std::vector<std::pair<Access_Operation, std::string> > AccessRulesRaw

Class and function definitions for the SciTokens plugin.

Definition at line 16 of file XrdSciTokensAccess.hh.

Enumeration Type Documentation

AuthzSetting

enum class AuthzSetting

strong

Enumerator
None
Read
Write
All

Definition at line 69 of file XrdSciTokensAccess.hh.

                        {
    None, // Issuer's authorization is not necessary
    Read, // Authorization from this issuer is necessary for reads.
    Write, // Authorization from this issuer is necessary for writes.
    All, // Authorization from this issuer is necessary for all operations.
};

IssuerAuthz

enum IssuerAuthz

Enumerator
Capability
Group
Mapping
Default

Definition at line 80 of file XrdSciTokensAccess.hh.

                 {
    Capability = 0x01,
    Group = 0x02,
    Mapping = 0x04,
    Default = 0x07
};

Function Documentation

AuthorizesRequiredIssuers()

bool AuthorizesRequiredIssuers	(	Access_Operation	client_oper,
		const std::string_view &	path,
		const std::vector< std::pair< std::unique_ptr< SubpathMatch >, std::string > > &	required_issuers,
		const std::vector< std::shared_ptr< XrdAccRules > > &	access_rules_list )

Definition at line 370 of file XrdSciTokensAccess.cc.

{
 
    // Translate the client-attempted operation to one of the simpler operations we've defined.
    Access_Operation oper;
    switch (client_oper) {
        case AOP_Any:
            return false; // Invalid request
            break;
        case AOP_Chmod: [[fallthrough]];
        case AOP_Chown: [[fallthrough]];
        case AOP_Create: [[fallthrough]];
        case AOP_Excl_Create: [[fallthrough]];
        case AOP_Delete: [[fallthrough]];
        case AOP_Excl_Insert: [[fallthrough]];
        case AOP_Insert: [[fallthrough]];
        case AOP_Lock:
            oper = AOP_Create;
            break;
        case AOP_Mkdir:
            oper = AOP_Mkdir;
            break;
        case AOP_Read:
            oper = AOP_Read;
            break;
        case AOP_Readdir:
            oper = AOP_Readdir;
            break;
        case AOP_Rename:
            oper = AOP_Create;
            break;
        case AOP_Stat:
            oper = AOP_Stat;
            break;
        case AOP_Update:
            oper = AOP_Update;
            break;
        default:
            return false; // Invalid request
    };
 
    // Iterate through all the required issuers
    for (const auto &info : required_issuers) {
        // See if this issuer is required for this path/operation.
        if (info.first->apply(oper, path)) {
            bool has_authz = false;
            // If so, see if one of the tokens (a) is from this issuer and (b) authorizes the request.
            for (const auto &rules : access_rules_list) {
                if (rules->get_issuer() == info.second && rules->apply(oper, path)) {
                    has_authz = true;
                    break;
                }
            }
            if (!has_authz) {
                return false;
            }
        }
    }
    return true;
}

References AOP_Any, AOP_Chmod, AOP_Chown, AOP_Create, AOP_Delete, AOP_Excl_Create, AOP_Excl_Insert, AOP_Insert, AOP_Lock, AOP_Mkdir, AOP_Read, AOP_Readdir, AOP_Rename, AOP_Stat, and AOP_Update.

Referenced by XrdAccSciTokens::Access().

Here is the caller graph for this function: