XRootD
XrdSciTokensAccess.hh File Reference
#include "XrdAcc/XrdAccAuthorize.hh"
#include "XrdOuc/XrdOucPrivateUtils.hh"
#include <memory>
#include <string>
#include <string_view>
#include <vector>
#include <string.h>
+ Include dependency graph for XrdSciTokensAccess.hh:
+ This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes

struct  MapRule
 
class  SubpathMatch
 
class  XrdAccRules
 

Typedefs

typedef std::vector< std::pair< Access_Operation, std::string > > AccessRulesRaw
 

Enumerations

enum class  AuthzSetting {
  None ,
  Read ,
  Write ,
  All
}
 
enum  IssuerAuthz {
  Capability = 0x01 ,
  Group = 0x02 ,
  Mapping = 0x04 ,
  Default = 0x07
}
 

Functions

bool AuthorizesRequiredIssuers (Access_Operation client_oper, const std::string_view &path, const std::vector< std::pair< std::unique_ptr< SubpathMatch >, std::string >> &required_issuers, const std::vector< std::shared_ptr< XrdAccRules >> &access_rules_list)
 

Typedef Documentation

◆ AccessRulesRaw

typedef std::vector<std::pair<Access_Operation, std::string> > AccessRulesRaw

Class and function definitions for the SciTokens plugin.

Definition at line 16 of file XrdSciTokensAccess.hh.

Enumeration Type Documentation

◆ AuthzSetting

enum AuthzSetting
strong
Enumerator
None 
Read 
Write 
All 

Definition at line 69 of file XrdSciTokensAccess.hh.

69  {
70  None, // Issuer's authorization is not necessary
71  Read, // Authorization from this issuer is necessary for reads.
72  Write, // Authorization from this issuer is necessary for writes.
73  All, // Authorization from this issuer is necessary for all operations.
74 };
WriteImpl< false > Write(Ctx< File > file, Arg< uint64_t > offset, Arg< uint32_t > size, Arg< const void * > buffer, uint16_t timeout=0)
Factory for creating WriteImpl objects.
ReadImpl< false > Read(Ctx< File > file, Arg< uint64_t > offset, Arg< uint32_t > size, Arg< void * > buffer, uint16_t timeout=0)
Factory for creating ReadImpl objects.

◆ IssuerAuthz

Enumerator
Capability 
Group 
Mapping 
Default 

Definition at line 80 of file XrdSciTokensAccess.hh.

80  {
81  Capability = 0x01,
82  Group = 0x02,
83  Mapping = 0x04,
84  Default = 0x07
85 };
@ Default
@ Capability
@ Mapping

Function Documentation

◆ AuthorizesRequiredIssuers()

bool AuthorizesRequiredIssuers ( Access_Operation  client_oper,
const std::string_view &  path,
const std::vector< std::pair< std::unique_ptr< SubpathMatch >, std::string >> &  required_issuers,
const std::vector< std::shared_ptr< XrdAccRules >> &  access_rules_list 
)

Definition at line 370 of file XrdSciTokensAccess.cc.

373 {
374 
375  // Translate the client-attempted operation to one of the simpler operations we've defined.
376  Access_Operation oper;
377  switch (client_oper) {
378  case AOP_Any:
379  return false; // Invalid request
380  break;
381  case AOP_Chmod: [[fallthrough]];
382  case AOP_Chown: [[fallthrough]];
383  case AOP_Create: [[fallthrough]];
384  case AOP_Excl_Create: [[fallthrough]];
385  case AOP_Delete: [[fallthrough]];
386  case AOP_Excl_Insert: [[fallthrough]];
387  case AOP_Insert: [[fallthrough]];
388  case AOP_Lock:
389  oper = AOP_Create;
390  break;
391  case AOP_Mkdir:
392  oper = AOP_Mkdir;
393  break;
394  case AOP_Read:
395  oper = AOP_Read;
396  break;
397  case AOP_Readdir:
398  oper = AOP_Readdir;
399  break;
400  case AOP_Rename:
401  oper = AOP_Create;
402  break;
403  case AOP_Stat:
404  oper = AOP_Stat;
405  break;
406  case AOP_Update:
407  oper = AOP_Update;
408  break;
409  default:
410  return false; // Invalid request
411  };
412 
413  // Iterate through all the required issuers
414  for (const auto &info : required_issuers) {
415  // See if this issuer is required for this path/operation.
416  if (info.first->apply(oper, path)) {
417  bool has_authz = false;
418  // If so, see if one of the tokens (a) is from this issuer and (b) authorizes the request.
419  for (const auto &rules : access_rules_list) {
420  if (rules->get_issuer() == info.second && rules->apply(oper, path)) {
421  has_authz = true;
422  break;
423  }
424  }
425  if (!has_authz) {
426  return false;
427  }
428  }
429  }
430  return true;
431 }
Access_Operation
The following are supported operations.
@ AOP_Delete
rm() or rmdir()
@ AOP_Mkdir
mkdir()
@ AOP_Update
open() r/w or append
@ AOP_Create
open() with create
@ AOP_Readdir
opendir()
@ AOP_Chmod
chmod()
@ AOP_Any
Special for getting privs.
@ AOP_Stat
exists(), stat()
@ AOP_Rename
mv() for source
@ AOP_Read
open() r/o, prepare()
@ AOP_Excl_Create
open() with O_EXCL|O_CREAT
@ AOP_Insert
mv() for target
@ AOP_Lock
n/a
@ AOP_Chown
chown()
@ AOP_Excl_Insert
mv() where destination doesn't exist.

References AOP_Any, AOP_Chmod, AOP_Chown, AOP_Create, AOP_Delete, AOP_Excl_Create, AOP_Excl_Insert, AOP_Insert, AOP_Lock, AOP_Mkdir, AOP_Read, AOP_Readdir, AOP_Rename, AOP_Stat, and AOP_Update.

Referenced by XrdAccSciTokens::Access().

+ Here is the caller graph for this function: