← Back to branch summary

~ubuntu-branches/ubuntu/vivid/ceilometer/vivid-proposed

« back to all changes in this revision

Viewing changes to ceilometer/api/rbac.py

  • Committer: Package Import Robot
  • Author(s): Chuck Short
  • Date: 2015-04-15 13:51:39 UTC
  • mfrom: (1.2.5)
  • Revision ID: package-import@ubuntu.com-20150415135139-wu1mlm9g91iibcu5
Tags: 2015.1~rc1-0ubuntu1
* New upstream milestone release:
  - d/control: Align with upstream dependencies.
  - d/p/disable-kafka.patch: Refreshed.

Show diffs side-by-side

added added

removed removed

Lines of Context:
ceilometer/api/rbac.py
25
25
CONF = cfg.CONF
26
26
 
27
27
 
 
28
def _has_rule(name):
 
29
    return name in _ENFORCER.rules.keys()
 
30
 
 
31
 
28
32
def enforce(policy_name, request):
29
33
    """Return the user and project the request should be limited to.
30
34
 
46
50
    policy_dict['target.user_id'] = (headers.get('X-User-Id'))
47
51
    policy_dict['target.project_id'] = (headers.get('X-Project-Id'))
48
52
 
49
 
    for rule_name in _ENFORCER.rules.keys():
50
 
        if rule_method == rule_name:
51
 
            if not _ENFORCER.enforce(
52
 
                    rule_name,
53
 
                    {},
54
 
                    policy_dict):
55
 
                pecan.core.abort(status_code=403,
56
 
                                 detail='RBAC Authorization Failed')
 
53
    # maintain backward compat with Juno and previous by allowing the action if
 
54
    # there is no rule defined for it
 
55
    if ((_has_rule('default') or _has_rule(rule_method)) and
 
56
            not _ENFORCER.enforce(rule_method, {}, policy_dict)):
 
57
        pecan.core.abort(status_code=403, detail='RBAC Authorization Failed')
57
58
 
58
59
 
59
60
# TODO(fabiog): these methods are still used because the scoping part is really
77
78
    policy_dict['target.user_id'] = (headers.get('X-User-Id'))
78
79
    policy_dict['target.project_id'] = (headers.get('X-Project-Id'))
79
80
 
80
 
    if not _ENFORCER.enforce('segregation',
 
81
    # maintain backward compat with Juno and previous by using context_is_admin
 
82
    # rule if the segregation rule (added in Kilo) is not defined
 
83
    rule_name = 'segregation' if _has_rule(
 
84
        'segregation') else 'context_is_admin'
 
85
    if not _ENFORCER.enforce(rule_name,
81
86
                             {},
82
87
                             policy_dict):
83
88
        return headers.get('X-User-Id'), headers.get('X-Project-Id')
 
89
 
84
90
    return None, None
85
91
 
86
92