XRootD
Loading...
Searching...
No Matches
XrdAccRules Class Reference
+ Collaboration diagram for XrdAccRules:

Public Member Functions

 XrdAccRules (uint64_t expiry_time, const std::string &username, const std::string &token_subject, const std::string &issuer, const std::vector< MapRule > &rules, const std::vector< std::string > &groups, uint32_t authz_strategy)
 
 ~XrdAccRules ()
 
bool apply (Access_Operation oper, std::string path)
 
bool expired () const
 
uint32_t get_authz_strategy () const
 
const std::string & get_default_username () const
 
const std::string & get_issuer () const
 
const std::string & get_token_subject () const
 
std::string get_username (const std::string &req_path) const
 
const std::vector< std::string > & groups () const
 
void parse (const AccessRulesRaw &rules)
 
size_t size () const
 
const std::string str () const
 

Detailed Description

Definition at line 349 of file XrdSciTokensAccess.cc.

Constructor & Destructor Documentation

◆ XrdAccRules()

XrdAccRules::XrdAccRules ( uint64_t expiry_time,
const std::string & username,
const std::string & token_subject,
const std::string & issuer,
const std::vector< MapRule > & rules,
const std::vector< std::string > & groups,
uint32_t authz_strategy )
inline

Definition at line 352 of file XrdSciTokensAccess.cc.

354 :
355 m_authz_strategy(authz_strategy),
356 m_expiry_time(expiry_time),
357 m_username(username),
358 m_token_subject(token_subject),
359 m_issuer(issuer),
360 m_map_rules(rules),
361 m_groups(groups)
362 {}
const std::vector< std::string > & groups() const

References groups().

+ Here is the call graph for this function:

◆ ~XrdAccRules()

XrdAccRules::~XrdAccRules ( )
inline

Definition at line 364 of file XrdSciTokensAccess.cc.

364{}

Member Function Documentation

◆ apply()

bool XrdAccRules::apply ( Access_Operation oper,
std::string path )
inline

Definition at line 366 of file XrdSciTokensAccess.cc.

366 {
367 auto is_subdirectory = [](const std::string& dir, const std::string& subdir) {
368 if (subdir.size() < dir.size())
369 return false;
370
371 if (subdir.compare(0, dir.size(), dir, 0, dir.size()) != 0)
372 return false;
373
374 return dir.size() == subdir.size() || subdir[dir.size()] == '/' || dir == "/";
375 };
376
377 for (const auto & rule : m_rules) {
378 // Skip rules that don't match the current operation
379 if (rule.first != oper)
380 continue;
381
382 // If the rule allows any path, allow the operation
383 if (rule.second == "/")
384 return true;
385
386 // Allow operation if path is a subdirectory of the rule's path
387 if (is_subdirectory(rule.second, path)) {
388 return true;
389 } else {
390 // Allow stat and mkdir of parent directories to comply with WLCG token specs
391 if (oper == AOP_Stat || oper == AOP_Mkdir)
392 if (is_subdirectory(path, rule.second))
393 return true;
394 }
395 }
396 return false;
397 }
@ AOP_Mkdir
mkdir()
@ AOP_Stat
exists(), stat()

References AOP_Mkdir, and AOP_Stat.

◆ expired()

bool XrdAccRules::expired ( ) const
inline

Definition at line 399 of file XrdSciTokensAccess.cc.

399{return monotonic_time() > m_expiry_time;}

◆ get_authz_strategy()

uint32_t XrdAccRules::get_authz_strategy ( ) const
inline

Definition at line 446 of file XrdSciTokensAccess.cc.

446{return m_authz_strategy;}

◆ get_default_username()

const std::string & XrdAccRules::get_default_username ( ) const
inline

Definition at line 443 of file XrdSciTokensAccess.cc.

443{return m_username;}

◆ get_issuer()

const std::string & XrdAccRules::get_issuer ( ) const
inline

Definition at line 444 of file XrdSciTokensAccess.cc.

444{return m_issuer;}

◆ get_token_subject()

const std::string & XrdAccRules::get_token_subject ( ) const
inline

Definition at line 442 of file XrdSciTokensAccess.cc.

442{return m_token_subject;}

◆ get_username()

std::string XrdAccRules::get_username ( const std::string & req_path) const
inline

Definition at line 408 of file XrdSciTokensAccess.cc.

409 {
410 for (const auto &rule : m_map_rules) {
411 std::string name = rule.match(m_token_subject, m_username, req_path, m_groups);
412 if (!name.empty()) {
413 return name;
414 }
415 }
416 return "";
417 }

◆ groups()

const std::vector< std::string > & XrdAccRules::groups ( ) const
inline

Definition at line 449 of file XrdSciTokensAccess.cc.

449{return m_groups;}

Referenced by XrdAccRules().

+ Here is the caller graph for this function:

◆ parse()

void XrdAccRules::parse ( const AccessRulesRaw & rules)
inline

Definition at line 401 of file XrdSciTokensAccess.cc.

401 {
402 m_rules.reserve(rules.size());
403 for (const auto &entry : rules) {
404 m_rules.emplace_back(entry.first, entry.second);
405 }
406 }

◆ size()

size_t XrdAccRules::size ( ) const
inline

Definition at line 448 of file XrdSciTokensAccess.cc.

448{return m_rules.size();}

◆ str()

const std::string XrdAccRules::str ( ) const
inline

Definition at line 419 of file XrdSciTokensAccess.cc.

420 {
421 std::stringstream ss;
422 ss << "mapped_username=" << m_username << ", subject=" << m_token_subject
423 << ", issuer=" << m_issuer;
424 if (!m_groups.empty()) {
425 ss << ", groups=";
426 bool first=true;
427 for (const auto &group : m_groups) {
428 ss << (first ? "" : ",") << group;
429 first = false;
430 }
431 }
432 if (!m_rules.empty()) {
433 ss << ", authorizations=" << AccessRuleStr(m_rules);
434 }
435 return ss.str();
436 }

The documentation for this class was generated from the following file: