471 enum class AuthzBehavior {
480 m_parms(parms ? parms :
""),
481 m_next_clean(monotonic_time() + m_expiry_secs),
482 m_log(lp,
"scitokens_")
484 pthread_rwlock_init(&m_config_lock,
nullptr);
485 m_config_lock_initialized =
true;
486 m_log.Say(
"++++++ XrdAccSciTokens: Initialized SciTokens-based authorization.");
488 throw std::runtime_error(
"Failed to configure SciTokens authorization.");
493 if (m_config_lock_initialized) {
494 pthread_rwlock_destroy(&m_config_lock);
503 const char *authz = env ? env->
Get(
"authz") :
nullptr;
508 if (authz && !strncmp(authz,
"Bearer%20", 9)) {
513 if (!authz && Entity && !strcmp(
"ztn", Entity->
prot) && Entity->
creds &&
516 authz = Entity->
creds;
518 if (authz ==
nullptr) {
519 return OnMissing(Entity, path, oper, env);
521 m_log.Log(LogMask::Debug,
"Access",
"Trying token-based access control");
522 std::shared_ptr<XrdAccRules> access_rules;
523 uint64_t now = monotonic_time();
526 std::lock_guard<std::mutex> guard(m_mutex);
527 const auto iter = m_map.find(authz);
528 if (iter != m_map.end() && !iter->second->expired()) {
529 access_rules = iter->second;
533 m_log.Log(LogMask::Debug,
"Access",
"Token not found in recent cache; parsing.");
535 uint64_t cache_expiry;
536 AccessRulesRaw rules;
537 std::string username;
538 std::string token_subject;
540 std::vector<MapRule> map_rules;
541 std::vector<std::string> groups;
542 uint32_t authz_strategy;
543 if (GenerateAcls(authz, cache_expiry, rules, username, token_subject, issuer, map_rules, groups, authz_strategy)) {
544 access_rules.reset(
new XrdAccRules(now + cache_expiry, username, token_subject, issuer, map_rules, groups, authz_strategy));
545 access_rules->parse(rules);
547 m_log.Log(LogMask::Warning,
"Access",
"Failed to generate ACLs for token");
548 return OnMissing(Entity, path, oper, env);
550 if (m_log.getMsgMask() & LogMask::Debug) {
551 m_log.Log(LogMask::Debug,
"Access",
"New valid token", access_rules->str().c_str());
553 }
catch (std::exception &exc) {
554 m_log.Log(LogMask::Warning,
"Access",
"Error generating ACLs for authorization", exc.what());
555 return OnMissing(Entity, path, oper, env);
557 std::lock_guard<std::mutex> guard(m_mutex);
558 m_map[authz] = access_rules;
559 }
else if (m_log.getMsgMask() & LogMask::Debug) {
560 m_log.Log(LogMask::Debug,
"Access",
"Cached token", access_rules->str().c_str());
575 new_secentity.
vorg =
nullptr;
576 new_secentity.
grps =
nullptr;
577 new_secentity.
role =
nullptr;
580 const auto &issuer = access_rules->get_issuer();
581 if (!issuer.empty()) {
582 new_secentity.
vorg = strdup(issuer.c_str());
584 bool group_success =
false;
585 if ((access_rules->get_authz_strategy() & IssuerAuthz::Group) && access_rules->groups().size()) {
586 std::stringstream ss;
587 for (
const auto &grp : access_rules->groups()) {
590 const auto &groups_str = ss.str();
591 new_secentity.
grps =
static_cast<char*
>(malloc(groups_str.size() + 1));
592 if (new_secentity.
grps) {
593 memcpy(new_secentity.
grps, groups_str.c_str(), groups_str.size());
594 new_secentity.
grps[groups_str.size()] =
'\0';
596 group_success =
true;
599 std::string username;
600 bool mapping_success =
false;
601 bool scope_success =
false;
602 username = access_rules->get_username(path);
604 mapping_success = (access_rules->get_authz_strategy() & IssuerAuthz::Mapping) && !username.empty();
605 scope_success = (access_rules->get_authz_strategy() & IssuerAuthz::Capability) && access_rules->apply(oper, path);
606 if (scope_success && (m_log.getMsgMask() & LogMask::Debug)) {
607 std::stringstream ss;
608 ss <<
"Grant authorization based on scopes for operation=" << OpToName(oper) <<
", path=" << path;
609 m_log.Log(LogMask::Debug,
"Access", ss.str().c_str());
612 if (!scope_success && !mapping_success && !group_success) {
613 auto returned_accs = OnMissing(&new_secentity, path, oper, env);
615 if (new_secentity.
vorg !=
nullptr) free(new_secentity.
vorg);
616 if (new_secentity.
grps !=
nullptr) free(new_secentity.
grps);
617 if (new_secentity.
role !=
nullptr) free(new_secentity.
role);
619 return returned_accs;
623 if (scope_success && username.empty()) {
624 username = access_rules->get_default_username();
629 if (scope_success || mapping_success) {
631 Entity->
eaAPI->
Add(
"request.name", username,
true);
632 new_secentity.
eaAPI->
Add(
"request.name", username,
true);
633 m_log.Log(LogMask::Debug,
"Access",
"Request username", username.c_str());
641 const auto &token_subject = access_rules->get_token_subject();
642 if (!token_subject.empty()) {
643 Entity->
eaAPI->
Add(
"token.subject", token_subject,
true);
652 if (Entity->
secMon && scope_success && returned_op &&
Mon_isIO(oper))
653 Mon_Report(new_secentity, token_subject, username);
656 if (new_secentity.
vorg !=
nullptr) free(new_secentity.
vorg);
657 if (new_secentity.
grps !=
nullptr) free(new_secentity.
grps);
658 if (new_secentity.
role !=
nullptr) free(new_secentity.
role);
674 for (
auto it: m_issuers) {
678 issuers.push_back(issuer_info);
684 virtual bool Validate(
const char *token, std::string &
emsg,
long long *expT,
692 if (!strncmp(token,
"Bearer%20", 9)) token += 9;
693 pthread_rwlock_rdlock(&m_config_lock);
694 auto retval = scitoken_deserialize(token, &scitoken, &m_valid_issuers_array[0], &err_msg);
695 pthread_rwlock_unlock(&m_config_lock);
698 m_log.Log(LogMask::Warning,
"Validate",
"Failed to deserialize SciToken:", err_msg);
709 {
char *value =
nullptr;
710 if (!scitoken_get_claim_string(scitoken,
"sub", &value, &err_msg))
711 Entity->
name = strdup(value);
716 if (expT && scitoken_get_expiration(scitoken, expT, &err_msg)) {
724 scitoken_destroy(scitoken);
742 return (m_chain ? m_chain->Test(priv, oper) : 0);
753 switch (m_authz_behavior) {
754 case AuthzBehavior::PASSTHROUGH:
756 case AuthzBehavior::ALLOW:
758 case AuthzBehavior::DENY:
765 bool GenerateAcls(
const std::string &authz, uint64_t &cache_expiry, AccessRulesRaw &rules, std::string &username, std::string &token_subject, std::string &issuer, std::vector<MapRule> &map_rules, std::vector<std::string> &groups, uint32_t &authz_strategy) {
768 bool looks_good =
true;
769 int separator_count = 0;
770 for (
auto cur_char = authz.c_str(); *cur_char; cur_char++) {
771 if (*cur_char ==
'.') {
773 if (separator_count > 2) {
777 if (!(*cur_char >= 65 && *cur_char <= 90) &&
778 !(*cur_char >= 97 && *cur_char <= 122) &&
779 !(*cur_char >= 48 && *cur_char <= 57) &&
780 (*cur_char != 43) && (*cur_char != 47) &&
781 (*cur_char != 45) && (*cur_char != 95))
787 if ((separator_count != 2) || (!looks_good)) {
788 m_log.Log(LogMask::Debug,
"Parse",
"Token does not appear to be a valid JWT; skipping.");
793 SciToken token =
nullptr;
794 pthread_rwlock_rdlock(&m_config_lock);
795 auto retval = scitoken_deserialize(authz.c_str(), &token, &m_valid_issuers_array[0], &err_msg);
796 pthread_rwlock_unlock(&m_config_lock);
799 m_log.Log(LogMask::Warning,
"GenerateAcls",
"Failed to deserialize SciToken:", err_msg);
805 if (scitoken_get_expiration(token, &expiry, &err_msg)) {
806 m_log.Log(LogMask::Warning,
"GenerateAcls",
"Unable to determine token expiration:", err_msg);
808 scitoken_destroy(token);
812 expiry = std::max(
static_cast<int64_t
>(monotonic_time() - expiry),
813 static_cast<int64_t
>(60));
818 char *value =
nullptr;
819 if (scitoken_get_claim_string(token,
"iss", &value, &err_msg)) {
820 m_log.Log(LogMask::Warning,
"GenerateAcls",
"Failed to get issuer:", err_msg);
821 scitoken_destroy(token);
825 std::string token_issuer(value);
828 pthread_rwlock_rdlock(&m_config_lock);
829 auto enf = enforcer_create(token_issuer.c_str(), &m_audiences_array[0], &err_msg);
830 pthread_rwlock_unlock(&m_config_lock);
832 m_log.Log(LogMask::Warning,
"GenerateAcls",
"Failed to create an enforcer:", err_msg);
833 scitoken_destroy(token);
839 if (enforcer_generate_acls(enf, token, &acls, &err_msg)) {
840 scitoken_destroy(token);
841 enforcer_destroy(enf);
842 m_log.Log(LogMask::Warning,
"GenerateAcls",
"ACL generation from SciToken failed:", err_msg);
846 enforcer_destroy(enf);
848 pthread_rwlock_rdlock(&m_config_lock);
849 auto iter = m_issuers.find(token_issuer);
850 if (iter == m_issuers.end()) {
851 pthread_rwlock_unlock(&m_config_lock);
852 m_log.Log(LogMask::Warning,
"GenerateAcls",
"Authorized issuer without a config.");
853 scitoken_destroy(token);
856 const auto config = iter->second;
857 pthread_rwlock_unlock(&m_config_lock);
861 std::vector<std::string> groups_parsed;
862 if (scitoken_get_claim_string_list(token, config.m_groups_claim.c_str(), &group_list, &err_msg) == 0) {
863 for (
int idx=0; group_list[idx]; idx++) {
864 groups_parsed.emplace_back(group_list[idx]);
866 scitoken_free_string_list(group_list);
869 m_log.Log(LogMask::Warning,
"GenerateAcls",
"Failed to get token groups:", err_msg);
873 if (scitoken_get_claim_string(token,
"sub", &value, &err_msg)) {
874 m_log.Log(LogMask::Warning,
"GenerateAcls",
"Failed to get token subject:", err_msg);
876 scitoken_destroy(token);
879 token_subject = std::string(value);
882 auto tmp_username = token_subject;
883 if (!config.m_username_claim.empty()) {
884 if (scitoken_get_claim_string(token, config.m_username_claim.c_str(), &value, &err_msg)) {
885 m_log.Log(LogMask::Warning,
"GenerateAcls",
"Failed to get token username:", err_msg);
887 scitoken_destroy(token);
890 tmp_username = std::string(value);
892 }
else if (!config.m_map_subject) {
893 tmp_username = config.m_default_user;
896 for (
auto rule : config.m_map_rules) {
897 for (
auto path : config.m_base_paths) {
898 auto path_rule = rule;
899 path_rule.m_path_prefix = path + rule.m_path_prefix;
900 auto pos = path_rule.m_path_prefix.find(
"//");
901 if (pos != std::string::npos) {
902 path_rule.m_path_prefix.erase(pos + 1, 1);
904 map_rules.emplace_back(path_rule);
908 AccessRulesRaw xrd_rules;
910 std::set<std::string> paths_write_seen;
911 std::set<std::string> paths_create_or_modify_seen;
912 std::vector<std::string> acl_paths;
913 acl_paths.reserve(config.m_restricted_paths.size() + 1);
914 while (acls[idx].resource && acls[idx++].authz) {
916 const auto &acl_path = acls[idx-1].resource;
917 const auto &acl_authz = acls[idx-1].authz;
918 if (config.m_restricted_paths.empty()) {
919 acl_paths.push_back(acl_path);
921 auto acl_path_size = strlen(acl_path);
922 for (
const auto &restricted_path : config.m_restricted_paths) {
925 if (!strncmp(acl_path, restricted_path.c_str(), restricted_path.size())) {
928 if (acl_path_size > restricted_path.size() && acl_path[restricted_path.size()] !=
'/') {
931 acl_paths.push_back(acl_path);
937 if (!strncmp(acl_path, restricted_path.c_str(), acl_path_size)) {
944 if ((restricted_path.size() > acl_path_size && restricted_path[acl_path_size] !=
'/') && (acl_path_size != 1)) {
947 acl_paths.push_back(restricted_path);
951 for (
const auto &acl_path : acl_paths) {
952 for (
const auto &base_path : config.m_base_paths) {
953 if (!acl_path[0] || acl_path[0] !=
'/') {
continue;}
955 MakeCanonical(base_path + acl_path, path);
956 if (!strcmp(acl_authz,
"read")) {
957 xrd_rules.emplace_back(
AOP_Read, path);
959 xrd_rules.emplace_back(
AOP_Stat, path);
960 }
else if (!strcmp(acl_authz,
"create")) {
961 paths_create_or_modify_seen.insert(path);
966 xrd_rules.emplace_back(
AOP_Stat, path);
967 }
else if (!strcmp(acl_authz,
"modify")) {
968 paths_create_or_modify_seen.insert(path);
975 xrd_rules.emplace_back(
AOP_Stat, path);
977 }
else if (!strcmp(acl_authz,
"write")) {
978 paths_write_seen.insert(path);
983 for (
const auto &write_path : paths_write_seen) {
984 if (paths_create_or_modify_seen.find(write_path) == paths_create_or_modify_seen.end()) {
986 xrd_rules.emplace_back(
AOP_Create, write_path);
987 xrd_rules.emplace_back(
AOP_Mkdir, write_path);
988 xrd_rules.emplace_back(
AOP_Rename, write_path);
989 xrd_rules.emplace_back(
AOP_Insert, write_path);
990 xrd_rules.emplace_back(
AOP_Update, write_path);
991 xrd_rules.emplace_back(
AOP_Stat, write_path);
992 xrd_rules.emplace_back(
AOP_Chmod, write_path);
993 xrd_rules.emplace_back(
AOP_Delete, write_path);
996 authz_strategy = config.m_authz_strategy;
998 cache_expiry = expiry;
999 rules = std::move(xrd_rules);
1000 username = std::move(tmp_username);
1001 issuer = std::move(token_issuer);
1002 groups = std::move(groups_parsed);
1008 bool Config(XrdOucEnv *envP) {
1010 m_log.setMsgMask(LogMask::Error | LogMask::Warning);
1012 char *config_filename =
nullptr;
1016 XrdOucGatherConf scitokens_conf(
"scitokens.trace", &m_log);
1019 m_log.Emsg(
"Config", -result,
"parsing config file", config_filename);
1024 std::string map_filename;
1025 while (scitokens_conf.GetLine()) {
1026 m_log.setMsgMask(0);
1027 scitokens_conf.GetToken();
1028 if (!(val = scitokens_conf.GetToken())) {
1029 m_log.Emsg(
"Config",
"scitokens.trace requires an argument. Usage: scitokens.trace [all|error|warning|info|debug|none]");
1033 if (!strcmp(val,
"all")) {m_log.setMsgMask(m_log.getMsgMask() | LogMask::All);}
1034 else if (!strcmp(val,
"error")) {m_log.setMsgMask(m_log.getMsgMask() | LogMask::Error);}
1035 else if (!strcmp(val,
"warning")) {m_log.setMsgMask(m_log.getMsgMask() | LogMask::Warning);}
1036 else if (!strcmp(val,
"info")) {m_log.setMsgMask(m_log.getMsgMask() | LogMask::Info);}
1037 else if (!strcmp(val,
"debug")) {m_log.setMsgMask(m_log.getMsgMask() | LogMask::Debug);}
1038 else if (!strcmp(val,
"none")) {m_log.setMsgMask(0);}
1039 else {m_log.Emsg(
"Config",
"scitokens.trace encountered an unknown directive:", val);
return false;}
1040 }
while ((val = scitokens_conf.GetToken()));
1042 m_log.Emsg(
"Config",
"Logging levels enabled -", LogMaskToString(m_log.getMsgMask()).c_str());
1044 auto xrdEnv =
static_cast<XrdOucEnv*
>(
envP ?
envP->
GetPtr(
"xrdEnv*") :
nullptr);
1045 auto tlsCtx =
static_cast<XrdTlsContext*
>(xrdEnv ? xrdEnv->GetPtr(
"XrdTlsContext*") :
nullptr);
1048 if (params && !params->cafile.empty()) {
1049#ifdef HAVE_SCITOKEN_CONFIG_SET_STR
1050 scitoken_config_set_str(
"tls.ca_file", params->cafile.c_str(),
nullptr);
1052 m_log.Log(LogMask::Warning,
"Config",
"tls.ca_file is set but the platform's libscitokens.so does not support setting config parameters");
1060 bool ParseMapfile(
const std::string &filename, std::vector<MapRule> &rules)
1062 std::stringstream ss;
1063 std::ifstream mapfile(filename);
1064 if (!mapfile.is_open())
1066 ss <<
"Error opening mapfile (" << filename <<
"): " << strerror(errno);
1067 m_log.Log(LogMask::Error,
"ParseMapfile", ss.str().c_str());
1070 picojson::value val;
1071 auto err = picojson::parse(val, mapfile);
1073 ss <<
"Unable to parse mapfile (" << filename <<
") as json: " << err;
1074 m_log.Log(LogMask::Error,
"ParseMapfile", ss.str().c_str());
1077 if (!val.is<picojson::array>()) {
1078 ss <<
"Top-level element of the mapfile " << filename <<
" must be a list";
1079 m_log.Log(LogMask::Error,
"ParseMapfile", ss.str().c_str());
1082 const auto& rule_list = val.get<picojson::array>();
1083 for (
const auto &rule : rule_list)
1085 if (!rule.is<picojson::object>()) {
1086 ss <<
"Mapfile " << filename <<
" must be a list of JSON objects; found non-object";
1087 m_log.Log(LogMask::Error,
"ParseMapfile", ss.str().c_str());
1093 std::string username;
1095 bool ignore =
false;
1096 for (
const auto &entry : rule.get<picojson::object>()) {
1097 if (!entry.second.is<std::string>()) {
1098 if (entry.first !=
"result" && entry.first !=
"group" && entry.first !=
"sub" && entry.first !=
"path") {
continue;}
1099 ss <<
"In mapfile " << filename <<
", rule entry for " << entry.first <<
" has non-string value";
1100 m_log.Log(LogMask::Error,
"ParseMapfile", ss.str().c_str());
1103 if (entry.first ==
"result") {
1104 result = entry.second.get<std::string>();
1106 else if (entry.first ==
"group") {
1107 group = entry.second.get<std::string>();
1109 else if (entry.first ==
"sub") {
1110 sub = entry.second.get<std::string>();
1111 }
else if (entry.first ==
"username") {
1112 username = entry.second.get<std::string>();
1113 }
else if (entry.first ==
"path") {
1114 std::string norm_path;
1115 if (!MakeCanonical(entry.second.get<std::string>(), norm_path)) {
1116 ss <<
"In mapfile " << filename <<
" encountered a path " << entry.second.get<std::string>()
1117 <<
" that cannot be normalized";
1118 m_log.Log(LogMask::Error,
"ParseMapfile", ss.str().c_str());
1122 }
else if (entry.first ==
"ignore") {
1127 if (ignore)
continue;
1130 ss <<
"In mapfile " << filename <<
" encountered a rule without a 'result' attribute";
1131 m_log.Log(LogMask::Error,
"ParseMapfile", ss.str().c_str());
1134 rules.emplace_back(sub, username, path, group, result);
1143 m_cfg_file =
"/etc/xrootd/scitokens.cfg";
1144 if (!m_parms.empty()) {
1146 std::vector<std::string> arg_list;
1148 while ((m_parms.size() > pos) && (m_parms[pos] ==
' ')) {pos++;}
1149 auto next_pos = m_parms.find_first_of(
", ", pos);
1150 auto next_arg = m_parms.substr(pos, next_pos - pos);
1152 if (!next_arg.empty()) {
1153 arg_list.emplace_back(std::move(next_arg));
1155 }
while (pos != std::string::npos);
1157 for (
const auto &arg : arg_list) {
1158 if (strncmp(arg.c_str(),
"config=", 7)) {
1159 m_log.Log(LogMask::Error,
"Reconfig",
"Ignoring unknown configuration argument:", arg.c_str());
1162 m_cfg_file = std::string(arg.c_str() + 7);
1165 m_log.Log(LogMask::Info,
"Reconfig",
"Parsing configuration file:", m_cfg_file.c_str());
1167 OverrideINIReader reader(m_cfg_file);
1168 if (reader.ParseError() < 0) {
1169 std::stringstream ss;
1170 ss <<
"Error opening config file (" << m_cfg_file <<
"): " << strerror(errno);
1171 m_log.Log(LogMask::Error,
"Reconfig", ss.str().c_str());
1173 }
else if (reader.ParseError()) {
1174 std::stringstream ss;
1175 ss <<
"Parse error on line " << reader.ParseError() <<
" of file " << m_cfg_file;
1176 m_log.Log(LogMask::Error,
"Reconfig", ss.str().c_str());
1179 std::vector<std::string> audiences;
1180 std::unordered_map<std::string, IssuerConfig> issuers;
1181 for (
const auto §ion : reader.Sections()) {
1182 std::string section_lower;
1183 std::transform(section.begin(), section.end(), std::back_inserter(section_lower),
1184 [](
unsigned char c){ return std::tolower(c); });
1186 if (section_lower.substr(0, 6) ==
"global") {
1187 auto audience = reader.Get(section,
"audience",
"");
1188 if (!audience.empty()) {
1191 while (audience.size() > pos && (audience[pos] ==
',' || audience[pos] ==
' ')) {pos++;}
1192 auto next_pos = audience.find_first_of(
", ", pos);
1193 auto next_aud = audience.substr(pos, next_pos - pos);
1195 if (!next_aud.empty()) {
1196 audiences.push_back(next_aud);
1198 }
while (pos != std::string::npos);
1200 audience = reader.Get(section,
"audience_json",
"");
1201 if (!audience.empty()) {
1202 picojson::value json_obj;
1203 auto err = picojson::parse(json_obj, audience);
1205 m_log.Log(LogMask::Error,
"Reconfig",
"Unable to parse audience_json:", err.c_str());
1208 if (!json_obj.is<picojson::value::array>()) {
1209 m_log.Log(LogMask::Error,
"Reconfig",
"audience_json must be a list of strings; not a list.");
1212 for (
const auto &val : json_obj.get<picojson::value::array>()) {
1213 if (!val.is<std::string>()) {
1214 m_log.Log(LogMask::Error,
"Reconfig",
"audience must be a list of strings; value is not a string.");
1217 audiences.push_back(val.get<std::string>());
1220 auto onmissing = reader.Get(section,
"onmissing",
"");
1221 if (onmissing ==
"passthrough") {
1222 m_authz_behavior = AuthzBehavior::PASSTHROUGH;
1223 }
else if (onmissing ==
"allow") {
1224 m_authz_behavior = AuthzBehavior::ALLOW;
1225 }
else if (onmissing ==
"deny") {
1226 m_authz_behavior = AuthzBehavior::DENY;
1227 }
else if (!onmissing.empty()) {
1228 m_log.Log(LogMask::Error,
"Reconfig",
"Unknown value for onmissing key:", onmissing.c_str());
1233 if (section_lower.substr(0, 7) !=
"issuer ") {
continue;}
1235 auto issuer = reader.Get(section,
"issuer",
"");
1236 if (issuer.empty()) {
1237 m_log.Log(LogMask::Error,
"Reconfig",
"Ignoring section because 'issuer' attribute is not set:",
1241 m_log.Log(LogMask::Debug,
"Reconfig",
"Configuring issuer", issuer.c_str());
1243 std::vector<MapRule> rules;
1244 auto name_mapfile = reader.Get(section,
"name_mapfile",
"");
1245 if (!name_mapfile.empty()) {
1246 if (!ParseMapfile(name_mapfile, rules)) {
1247 m_log.Log(LogMask::Error,
"Reconfig",
"Failed to parse mapfile; failing (re-)configuration", name_mapfile.c_str());
1250 m_log.Log(LogMask::Info,
"Reconfig",
"Successfully parsed SciTokens mapfile:", name_mapfile.c_str());
1254 auto base_path = reader.Get(section,
"base_path",
"");
1255 if (base_path.empty()) {
1256 m_log.Log(LogMask::Error,
"Reconfig",
"Ignoring section because 'base_path' attribute is not set:",
1262 while (section.size() > pos && std::isspace(section[pos])) {pos++;}
1264 auto name = section.substr(pos);
1266 m_log.Log(LogMask::Error,
"Reconfig",
"Invalid section name:", section.c_str());
1270 std::vector<std::string> base_paths;
1271 ParseCanonicalPaths(base_path, base_paths);
1273 auto restricted_path = reader.Get(section,
"restricted_path",
"");
1274 std::vector<std::string> restricted_paths;
1275 if (!restricted_path.empty()) {
1276 ParseCanonicalPaths(restricted_path, restricted_paths);
1279 auto default_user = reader.Get(section,
"default_user",
"");
1280 auto map_subject = reader.GetBoolean(section,
"map_subject",
false);
1281 auto username_claim = reader.Get(section,
"username_claim",
"");
1282 auto groups_claim = reader.Get(section,
"groups_claim",
"wlcg.groups");
1284 auto authz_strategy_str = reader.Get(section,
"authorization_strategy",
"");
1285 uint32_t authz_strategy = 0;
1286 if (authz_strategy_str.empty()) {
1287 authz_strategy = IssuerAuthz::Default;
1289 std::istringstream authz_strategy_stream(authz_strategy_str);
1290 std::string authz_str;
1291 while (std::getline(authz_strategy_stream, authz_str,
' ')) {
1292 if (!strcasecmp(authz_str.c_str(),
"capability")) {
1293 authz_strategy |= IssuerAuthz::Capability;
1294 }
else if (!strcasecmp(authz_str.c_str(),
"group")) {
1295 authz_strategy |= IssuerAuthz::Group;
1296 }
else if (!strcasecmp(authz_str.c_str(),
"mapping")) {
1297 authz_strategy |= IssuerAuthz::Mapping;
1299 m_log.Log(LogMask::Error,
"Reconfig",
"Unknown authorization strategy (ignoring):", authz_str.c_str());
1304 issuers.emplace(std::piecewise_construct,
1305 std::forward_as_tuple(issuer),
1306 std::forward_as_tuple(name, issuer, base_paths, restricted_paths,
1307 map_subject, authz_strategy, default_user, username_claim, groups_claim, rules));
1310 if (issuers.empty()) {
1311 m_log.Log(LogMask::Warning,
"Reconfig",
"No issuers configured.");
1314 pthread_rwlock_wrlock(&m_config_lock);
1316 m_audiences = std::move(audiences);
1318 m_audiences_array.resize(m_audiences.size() + 1);
1319 for (
const auto &audience : m_audiences) {
1320 m_audiences_array[idx++] = audience.c_str();
1322 m_audiences_array[idx] =
nullptr;
1324 m_issuers = std::move(issuers);
1325 m_valid_issuers_array.resize(m_issuers.size() + 1);
1327 for (
const auto &issuer : m_issuers) {
1328 m_valid_issuers_array[idx++] = issuer.first.c_str();
1330 m_valid_issuers_array[idx] =
nullptr;
1332 pthread_rwlock_unlock(&m_config_lock);
1335 pthread_rwlock_unlock(&m_config_lock);
1339 void Check(uint64_t now)
1341 if (now <= m_next_clean) {
return;}
1342 std::lock_guard<std::mutex> guard(m_mutex);
1344 for (
auto iter = m_map.begin(); iter != m_map.end(); ) {
1345 if (iter->second->expired()) {
1346 iter = m_map.erase(iter);
1353 m_next_clean = monotonic_time() + m_expiry_secs;
1356 bool m_config_lock_initialized{
false};
1358 pthread_rwlock_t m_config_lock;
1359 std::vector<std::string> m_audiences;
1360 std::vector<const char *> m_audiences_array;
1361 std::map<std::string, std::shared_ptr<XrdAccRules>> m_map;
1363 const std::string m_parms;
1364 std::vector<const char*> m_valid_issuers_array;
1365 std::unordered_map<std::string, IssuerConfig> m_issuers;
1366 uint64_t m_next_clean{0};
1368 AuthzBehavior m_authz_behavior{AuthzBehavior::PASSTHROUGH};
1369 std::string m_cfg_file;
1371 static constexpr uint64_t m_expiry_secs = 60;