May 2007 - calendarserver-changes - lists.macosforge.org

[1581] CalendarServer/trunk/twistedcaldav
by source_changes＠macosforge.org 30 May '07

30 May '07

Revision: 1581 http://trac.macosforge.org/projects/calendarserver/changeset/1581 Author: cdaboo(a)apple.com Date: 2007-05-30 14:44:02 -0700 (Wed, 30 May 2007) Log Message: ----------- Merge of branches/users/cdaboo/sacl-1576 to trunk. Modified Paths: -------------- CalendarServer/trunk/twistedcaldav/extensions.py CalendarServer/trunk/twistedcaldav/root.py Modified: CalendarServer/trunk/twistedcaldav/extensions.py =================================================================== --- CalendarServer/trunk/twistedcaldav/extensions.py 2007-05-30 19:58:59 UTC (rev 1580) +++ CalendarServer/trunk/twistedcaldav/extensions.py 2007-05-30 21:44:02 UTC (rev 1581) @@ -24,7 +24,7 @@ "DAVResource", "DAVFile", "ReadOnlyResourceMixIn", - "SudoAuthIDMixin", + "SudoSACLMixin", ] import cPickle as pickle @@ -49,12 +49,22 @@ from twistedcaldav.directory.sudo import SudoDirectoryService from twistedcaldav.directory.directory import DirectoryService -class SudoAuthIDMixin(object): +class SudoSACLMixin(object): """ Mixin class to let DAVResource, and DAVFile subclasses below know about sudoer principals and how to find their AuthID """ + def authenticate(self, request): + # Bypass normal authentication if its already been done (by SACL check) + if (hasattr(request, "authnUser") and + hasattr(request, "authzUser") and + request.authnUser is not None and + request.authzUser is not None): + return (request.authnUser, request.authzUser) + else: + return super(SudoSACLMixin, self).authenticate(request) + def findPrincipalForAuthID(self, authid): """ Return an authentication and authorization principal identifiers for @@ -68,7 +78,7 @@ if principal is not None: return principal - return super(SudoAuthIDMixin, self).findPrincipalForAuthID(authid) + return super(SudoSACLMixin, self).findPrincipalForAuthID(authid) def authorizationPrincipal(self, request, authid, authnPrincipal): """ @@ -131,7 +141,7 @@ raise HTTPError(responsecode.FORBIDDEN) else: # No proxy - do default behavior - d = waitForDeferred(super(SudoAuthIDMixin, self).authorizationPrincipal(request, authid, authnPrincipal)) + d = waitForDeferred(super(SudoSACLMixin, self).authorizationPrincipal(request, authid, authnPrincipal)) yield d yield d.getResult() return @@ -139,8 +149,7 @@ authorizationPrincipal = deferredGenerator(authorizationPrincipal) - -class DAVResource (SudoAuthIDMixin, SuperDAVResource): +class DAVResource (SudoSACLMixin, SuperDAVResource): """ Extended L{twisted.web2.dav.resource.DAVResource} implementation. """ @@ -335,7 +344,7 @@ return davxml.ResourceType(davxml.Principal()) -class DAVFile (SudoAuthIDMixin, SuperDAVFile): +class DAVFile (SudoSACLMixin, SuperDAVFile): """ Extended L{twisted.web2.dav.static.DAVFile} implementation. """ Modified: CalendarServer/trunk/twistedcaldav/root.py =================================================================== --- CalendarServer/trunk/twistedcaldav/root.py 2007-05-30 19:58:59 UTC (rev 1580) +++ CalendarServer/trunk/twistedcaldav/root.py 2007-05-30 21:44:02 UTC (rev 1581) @@ -48,7 +48,7 @@ self.useSacls = True else: log.msg(("RootResource.CheckSACL is unset but " - "config.EnableSACLs is True, SACLs will not be" + "config.EnableSACLs is True, SACLs will not be " "turned on.")) self.contentFilters = [] @@ -83,6 +83,10 @@ request.remoteAddr))) def _checkSACLCb((authnUser, authzUser)): + # Cache the authentication details + request.authnUser = authnUser + request.authzUser = authzUser + # Figure out the "username" from the davxml.Principal object username = authzUser.children[0].children[0].data username = username.rstrip('/').split('/')[-1] @@ -91,6 +95,8 @@ log.msg("User '%s' is not enabled with the '%s' SACL" % (username, self.saclService,)) return Failure(HTTPError(403)) + # Mark SACL's as having been checked so we can avoid doing it multiple times + request.checkedSACL = True return True d = defer.maybeDeferred(self.authenticate, request) @@ -102,7 +108,7 @@ for filter in self.contentFilters: request.addResponseFilter(filter[0], atEnd=filter[1]) - if self.useSacls: + if self.useSacls and not hasattr(request, "checkedSACL"): d = self.checkSacl(request) d.addCallback(lambda _: super(RootResource, self ).locateChild(request, segments))

1 0

[1580] CalendarServer/branches/users/cdaboo/sacl-1576/twistedcaldav
by source_changes＠macosforge.org 30 May '07

30 May '07

Revision: 1580 http://trac.macosforge.org/projects/calendarserver/changeset/1580 Author: cdaboo(a)apple.com Date: 2007-05-30 12:58:59 -0700 (Wed, 30 May 2007) Log Message: ----------- Fix for SACL check causing Kerberos auth to fail. Plus optimize SACL check so it only happens once in any one request. Modified Paths: -------------- CalendarServer/branches/users/cdaboo/sacl-1576/twistedcaldav/extensions.py CalendarServer/branches/users/cdaboo/sacl-1576/twistedcaldav/root.py Modified: CalendarServer/branches/users/cdaboo/sacl-1576/twistedcaldav/extensions.py =================================================================== --- CalendarServer/branches/users/cdaboo/sacl-1576/twistedcaldav/extensions.py 2007-05-30 17:31:35 UTC (rev 1579) +++ CalendarServer/branches/users/cdaboo/sacl-1576/twistedcaldav/extensions.py 2007-05-30 19:58:59 UTC (rev 1580) @@ -24,7 +24,7 @@ "DAVResource", "DAVFile", "ReadOnlyResourceMixIn", - "SudoAuthIDMixin", + "SudoSACLMixin", ] import cPickle as pickle @@ -49,12 +49,22 @@ from twistedcaldav.directory.sudo import SudoDirectoryService from twistedcaldav.directory.directory import DirectoryService -class SudoAuthIDMixin(object): +class SudoSACLMixin(object): """ Mixin class to let DAVResource, and DAVFile subclasses below know about sudoer principals and how to find their AuthID """ + def authenticate(self, request): + # Bypass normal authentication if its already been done (by SACL check) + if (hasattr(request, "authnUser") and + hasattr(request, "authzUser") and + request.authnUser is not None and + request.authzUser is not None): + return (request.authnUser, request.authzUser) + else: + return super(SudoSACLMixin, self).authenticate(request) + def findPrincipalForAuthID(self, authid): """ Return an authentication and authorization principal identifiers for @@ -68,7 +78,7 @@ if principal is not None: return principal - return super(SudoAuthIDMixin, self).findPrincipalForAuthID(authid) + return super(SudoSACLMixin, self).findPrincipalForAuthID(authid) def authorizationPrincipal(self, request, authid, authnPrincipal): """ @@ -131,7 +141,7 @@ raise HTTPError(responsecode.FORBIDDEN) else: # No proxy - do default behavior - d = waitForDeferred(super(SudoAuthIDMixin, self).authorizationPrincipal(request, authid, authnPrincipal)) + d = waitForDeferred(super(SudoSACLMixin, self).authorizationPrincipal(request, authid, authnPrincipal)) yield d yield d.getResult() return @@ -139,8 +149,7 @@ authorizationPrincipal = deferredGenerator(authorizationPrincipal) - -class DAVResource (SudoAuthIDMixin, SuperDAVResource): +class DAVResource (SudoSACLMixin, SuperDAVResource): """ Extended L{twisted.web2.dav.resource.DAVResource} implementation. """ @@ -335,7 +344,7 @@ return davxml.ResourceType(davxml.Principal()) -class DAVFile (SudoAuthIDMixin, SuperDAVFile): +class DAVFile (SudoSACLMixin, SuperDAVFile): """ Extended L{twisted.web2.dav.static.DAVFile} implementation. """ Modified: CalendarServer/branches/users/cdaboo/sacl-1576/twistedcaldav/root.py =================================================================== --- CalendarServer/branches/users/cdaboo/sacl-1576/twistedcaldav/root.py 2007-05-30 17:31:35 UTC (rev 1579) +++ CalendarServer/branches/users/cdaboo/sacl-1576/twistedcaldav/root.py 2007-05-30 19:58:59 UTC (rev 1580) @@ -48,7 +48,7 @@ self.useSacls = True else: log.msg(("RootResource.CheckSACL is unset but " - "config.EnableSACLs is True, SACLs will not be" + "config.EnableSACLs is True, SACLs will not be " "turned on.")) self.contentFilters = [] @@ -83,6 +83,10 @@ request.remoteAddr))) def _checkSACLCb((authnUser, authzUser)): + # Cache the authentication details + request.authnUser = authnUser + request.authzUser = authzUser + # Figure out the "username" from the davxml.Principal object username = authzUser.children[0].children[0].data username = username.rstrip('/').split('/')[-1] @@ -91,6 +95,8 @@ log.msg("User '%s' is not enabled with the '%s' SACL" % (username, self.saclService,)) return Failure(HTTPError(403)) + # Mark SACL's as having been checked so we can avoid doing it multiple times + request.checkedSACL = True return True d = defer.maybeDeferred(self.authenticate, request) @@ -102,7 +108,7 @@ for filter in self.contentFilters: request.addResponseFilter(filter[0], atEnd=filter[1]) - if self.useSacls: + if self.useSacls and not hasattr(request, "checkedSACL"): d = self.checkSacl(request) d.addCallback(lambda _: super(RootResource, self ).locateChild(request, segments))

1 0

[1579] CalendarServer/branches/users/cdaboo/sacl-1576/
by source_changes＠macosforge.org 30 May '07

30 May '07

Revision: 1579 http://trac.macosforge.org/projects/calendarserver/changeset/1579 Author: cdaboo(a)apple.com Date: 2007-05-30 10:31:35 -0700 (Wed, 30 May 2007) Log Message: ----------- Branch to fix SACL double-authentication problem. Added Paths: ----------- CalendarServer/branches/users/cdaboo/sacl-1576/ Copied: CalendarServer/branches/users/cdaboo/sacl-1576 (from rev 1576, CalendarServer/trunk)

1 0

[1578] CalendarServer/trunk/twistedcaldav/method/report_calquery.py
by source_changes＠macosforge.org 29 May '07

29 May '07

Revision: 1578 http://trac.macosforge.org/projects/calendarserver/changeset/1578 Author: cdaboo(a)apple.com Date: 2007-05-29 10:07:59 -0700 (Tue, 29 May 2007) Log Message: ----------- Bump up the limit on the number of results for a query. Modified Paths: -------------- CalendarServer/trunk/twistedcaldav/method/report_calquery.py Modified: CalendarServer/trunk/twistedcaldav/method/report_calquery.py =================================================================== --- CalendarServer/trunk/twistedcaldav/method/report_calquery.py 2007-05-29 17:06:24 UTC (rev 1577) +++ CalendarServer/trunk/twistedcaldav/method/report_calquery.py 2007-05-29 17:07:59 UTC (rev 1578) @@ -29,13 +29,14 @@ from twisted.web2.dav.element.base import dav_namespace from twisted.web2.dav.http import ErrorResponse, MultiStatusResponse from twisted.web2.dav.method.report import NumberOfMatchesWithinLimits -from twisted.web2.dav.method.report import max_number_of_matches from twisted.web2.dav.util import joinURL from twisted.web2.http import HTTPError, StatusResponse from twistedcaldav.caldavxml import caldav_namespace from twistedcaldav.method import report_common +max_number_of_results = 1000 + def report_urn_ietf_params_xml_ns_caldav_calendar_query(self, request, calendar_query): """ Generate a calendar-query REPORT. @@ -115,7 +116,7 @@ if query_ok or filter.match(calendar): # Check size of results is within limit matchcount[0] += 1 - if matchcount[0] > max_number_of_matches: + if matchcount[0] > max_number_of_results: raise NumberOfMatchesWithinLimits if name:

1 0

[1577] CalDAVTester/trunk/scripts/tests/errors.xml
by source_changes＠macosforge.org 29 May '07

29 May '07

Revision: 1577 http://trac.macosforge.org/projects/calendarserver/changeset/1577 Author: cdaboo(a)apple.com Date: 2007-05-29 10:06:24 -0700 (Tue, 29 May 2007) Log Message: ----------- The query report now allows up to 1000 events so we need to add one event to our 1000 event calendar in order to trigger the 'too many items' error. Modified Paths: -------------- CalDAVTester/trunk/scripts/tests/errors.xml Modified: CalDAVTester/trunk/scripts/tests/errors.xml =================================================================== --- CalDAVTester/trunk/scripts/tests/errors.xml 2007-05-25 23:19:35 UTC (rev 1576) +++ CalDAVTester/trunk/scripts/tests/errors.xml 2007-05-29 17:06:24 UTC (rev 1577) @@ -1026,7 +1026,18 @@ <test-suite name='REPORT/too big' ignore='no'> <test name='1'> - <description>query with too many results</description> + <description>add one event to make it a 1001 event calendar</description> + <request end-delete="yes" print-response='no'> + <method>PUT</method> + <ruri>$pathprefix:/calendar.1000/abc.ics</ruri> + <data> + <content-type>text/calendar; charset=utf-8</content-type> + <filepath>Resource/errors/6.txt</filepath> + </data> + <verify> + <callback>statusCode</callback> + </verify> + </request> <request print-response='no'> <method>REPORT</method> <ruri>$pathprefix:/calendar.1000/</ruri>

1 0

[1576] CalendarServer/trunk/conf
by source_changes＠macosforge.org 25 May '07

25 May '07

Revision: 1576 http://trac.macosforge.org/projects/calendarserver/changeset/1576 Author: wsanchez(a)apple.com Date: 2007-05-25 16:19:35 -0700 (Fri, 25 May 2007) Log Message: ----------- Modified Paths: -------------- CalendarServer/trunk/conf/caldavd-test.plist CalendarServer/trunk/conf/caldavd.plist Modified: CalendarServer/trunk/conf/caldavd-test.plist =================================================================== --- CalendarServer/trunk/conf/caldavd-test.plist 2007-05-25 23:08:14 UTC (rev 1575) +++ CalendarServer/trunk/conf/caldavd-test.plist 2007-05-25 23:19:35 UTC (rev 1576) @@ -330,6 +330,7 @@ <key>EnableNotifications</key> <true/> +  @@ -340,6 +341,7 @@ <string>../Twisted/bin/twistd</string> </dict> +  @@ -356,6 +358,7 @@ <string>logs/caldavd-pydir.sock</string> </dict> +  Modified: CalendarServer/trunk/conf/caldavd.plist =================================================================== --- CalendarServer/trunk/conf/caldavd.plist 2007-05-25 23:08:14 UTC (rev 1575) +++ CalendarServer/trunk/conf/caldavd.plist 2007-05-25 23:19:35 UTC (rev 1576) @@ -261,6 +261,7 @@ <key>EnableNotifications</key> <true/> +

1 0

[1575] CalendarServer/trunk/conf/caldavd.plist
by source_changes＠macosforge.org 25 May '07

25 May '07

Revision: 1575 http://trac.macosforge.org/projects/calendarserver/changeset/1575 Author: wsanchez(a)apple.com Date: 2007-05-25 16:08:14 -0700 (Fri, 25 May 2007) Log Message: ----------- Turn Basic back on for now. Modified Paths: -------------- CalendarServer/trunk/conf/caldavd.plist Modified: CalendarServer/trunk/conf/caldavd.plist =================================================================== --- CalendarServer/trunk/conf/caldavd.plist 2007-05-25 23:07:55 UTC (rev 1574) +++ CalendarServer/trunk/conf/caldavd.plist 2007-05-25 23:08:14 UTC (rev 1575) @@ -156,7 +156,7 @@ <key>Basic</key> <dict> <key>Enabled</key> - <false/> + <true/> </dict>

1 0

[1574] CalendarServer/trunk/conf/caldavd-test.plist
by source_changes＠macosforge.org 25 May '07

25 May '07

Revision: 1574 http://trac.macosforge.org/projects/calendarserver/changeset/1574 Author: wsanchez(a)apple.com Date: 2007-05-25 16:07:55 -0700 (Fri, 25 May 2007) Log Message: ----------- Turn on Digest and Kerberos auth in test plist. Modified Paths: -------------- CalendarServer/trunk/conf/caldavd-test.plist Modified: CalendarServer/trunk/conf/caldavd-test.plist =================================================================== --- CalendarServer/trunk/conf/caldavd-test.plist 2007-05-25 22:44:43 UTC (rev 1573) +++ CalendarServer/trunk/conf/caldavd-test.plist 2007-05-25 23:07:55 UTC (rev 1574) @@ -216,7 +216,7 @@ <key>Digest</key> <dict> <key>Enabled</key> - <false/> + <true/> <key>Algorithm</key> <string>md5</string> <key>Qop</key> @@ -227,7 +227,7 @@ <key>Kerberos</key> <dict> <key>Enabled</key> - <false/> + <true/> <key>ServicePrincipal</key> <string></string> </dict>

1 0

[1573] CalendarServer/trunk/twistedcaldav/directory/appleopendirectory.py
by source_changes＠macosforge.org 25 May '07

25 May '07

Revision: 1573 http://trac.macosforge.org/projects/calendarserver/changeset/1573 Author: dreid(a)apple.com Date: 2007-05-25 15:44:43 -0700 (Fri, 25 May 2007) Log Message: ----------- Check for the apple-serviceinfo attribute first, also use a complex query to get the records containing the virtual host name Modified Paths: -------------- CalendarServer/trunk/twistedcaldav/directory/appleopendirectory.py Modified: CalendarServer/trunk/twistedcaldav/directory/appleopendirectory.py =================================================================== --- CalendarServer/trunk/twistedcaldav/directory/appleopendirectory.py 2007-05-25 17:59:23 UTC (rev 1572) +++ CalendarServer/trunk/twistedcaldav/directory/appleopendirectory.py 2007-05-25 22:44:43 UTC (rev 1573) @@ -124,13 +124,22 @@ dsattributes.kDSNAttrRecordName, dsattributes.kDS1AttrXMLPlist, dsattributes.kDSNAttrMetaNodeLocation, + 'dsAttrTypeNative:apple-serviceinfo', ] - records = opendirectory.queryRecordsWithAttribute( + from dsquery import expression, match + + records = opendirectory.queryRecordsWithAttributes( self.directory, - dsattributes.kDS1AttrXMLPlist, - vhostname, - dsattributes.eDSContains, + expression( + expression.OR, + ( + match(dsattributes.kDS1AttrXMLPlist, + vhostname, + dsattributes.eDSContains), + match('dsAttrTypeNative:apple-serviceinfo', + vhostname, + dsattributes.eDSContains))).generate(), True, # case insentive for hostnames dsattributes.kDSStdRecordTypeComputers, attrs @@ -157,11 +166,17 @@ _remoteNode = None for recordname, record in records.iteritems(): - # Must have XMLPlist value - plist = record.get(dsattributes.kDS1AttrXMLPlist, None) + # May have an apple-serviceinfo + plist = record.get('dsAttrTypeNative:apple-serviceinfo', None) + if not plist: - continue + # May have XMLPlist value + plist = record.get(dsattributes.kDS1AttrXMLPlist, None) + # Must have one of the other + if not plist: + continue + # XXX: Parse the plist so we can find only calendar vhosts with our hostname. plistDict = readPlistFromString(plist) vhosts = plistDict.get("com.apple.macosxserver.virtualhosts", None)

1 0

[1572] CalendarServer/trunk/twistedcaldav
by source_changes＠macosforge.org 25 May '07

25 May '07

Revision: 1572 http://trac.macosforge.org/projects/calendarserver/changeset/1572 Author: dreid(a)apple.com Date: 2007-05-25 10:59:23 -0700 (Fri, 25 May 2007) Log Message: ----------- Move implementation of authorizationPrincipal to the SudoAuthIDMixin which gets shoehorned into the MRO of the CalDAVResource where this was previously. This moves sudo authorization onto the DAVResource and DAVFile extensions, which means the RootResource (a DAVFile) can do the resolution before checking SACLs Modified Paths: -------------- CalendarServer/trunk/twistedcaldav/extensions.py CalendarServer/trunk/twistedcaldav/resource.py Modified: CalendarServer/trunk/twistedcaldav/extensions.py =================================================================== --- CalendarServer/trunk/twistedcaldav/extensions.py 2007-05-25 02:40:24 UTC (rev 1571) +++ CalendarServer/trunk/twistedcaldav/extensions.py 2007-05-25 17:59:23 UTC (rev 1572) @@ -47,8 +47,8 @@ from twisted.web2.dav.resource import DAVPrincipalResource as SuperDAVPrincipalResource from twisted.web2.dav.util import joinURL from twistedcaldav.directory.sudo import SudoDirectoryService +from twistedcaldav.directory.directory import DirectoryService - class SudoAuthIDMixin(object): """ Mixin class to let DAVResource, and DAVFile subclasses below know @@ -70,7 +70,76 @@ return super(SudoAuthIDMixin, self).findPrincipalForAuthID(authid) + def authorizationPrincipal(self, request, authid, authnPrincipal): + """ + Determine the authorization principal for the given request and authentication principal. + This implementation looks for an X-Authorize-As header value to use as the authoization principal. + + @param request: the L{IRequest} for the request in progress. + @param authid: a string containing the uthentication/authorization identifier + for the principal to lookup. + @param authnPrincipal: the L{IDAVPrincipal} for the authenticated principal + @return: a deferred result C{tuple} of (L{IDAVPrincipal}, C{str}) containing the authorization principal + resource and URI respectively. + """ + # FIXME: Unroll defgen + # Look for X-Authorize-As Header + authz = request.headers.getRawHeaders("x-authorize-as") + + if authz is not None and (len(authz) == 1): + # Substitute the authz value for principal look up + authz = authz[0] + + def getPrincipalForType(type, name): + for collection in self.principalCollections(): + principal = collection.principalForShortName(type, name) + if principal: + return principal + + def isSudoPrincipal(authid): + if getPrincipalForType(SudoDirectoryService.recordType_sudoers, + authid): + return True + return False + + if isSudoPrincipal(authid): + if authz: + if isSudoPrincipal(authz): + log.msg("Cannot proxy as another proxy: user '%s' as user '%s'" % (authid, authz)) + raise HTTPError(responsecode.FORBIDDEN) + else: + authzPrincipal = getPrincipalForType( + DirectoryService.recordType_groups, authz) + + if not authzPrincipal: + authzPrincipal = self.findPrincipalForAuthID(authz) + + if authzPrincipal is not None: + log.msg("Allow proxy: user '%s' as '%s'" % (authid, authz,)) + yield authzPrincipal + return + else: + log.msg("Could not find authorization user id: '%s'" % + (authz,)) + raise HTTPError(responsecode.FORBIDDEN) + else: + log.msg("Cannot authenticate proxy user '%s' without X-Authorize-As header" % (authid, )) + raise HTTPError(responsecode.BAD_REQUEST) + elif authz: + log.msg("Cannot proxy: user '%s' as '%s'" % (authid, authz,)) + raise HTTPError(responsecode.FORBIDDEN) + else: + # No proxy - do default behavior + d = waitForDeferred(super(SudoAuthIDMixin, self).authorizationPrincipal(request, authid, authnPrincipal)) + yield d + yield d.getResult() + return + + authorizationPrincipal = deferredGenerator(authorizationPrincipal) + + + class DAVResource (SudoAuthIDMixin, SuperDAVResource): """ Extended L{twisted.web2.dav.resource.DAVResource} implementation. Modified: CalendarServer/trunk/twistedcaldav/resource.py =================================================================== --- CalendarServer/trunk/twistedcaldav/resource.py 2007-05-25 02:40:24 UTC (rev 1571) +++ CalendarServer/trunk/twistedcaldav/resource.py 2007-05-25 17:59:23 UTC (rev 1572) @@ -235,74 +235,6 @@ return super(CalDAVResource, self).accessControlList(*args, **kwargs) - def authorizationPrincipal(self, request, authid, authnPrincipal): - """ - Determine the authorization principal for the given request and authentication principal. - This implementation looks for an X-Authorize-As header value to use as the authoization principal. - - @param request: the L{IRequest} for the request in progress. - @param authid: a string containing the uthentication/authorization identifier - for the principal to lookup. - @param authnPrincipal: the L{IDAVPrincipal} for the authenticated principal - @return: a deferred result C{tuple} of (L{IDAVPrincipal}, C{str}) containing the authorization principal - resource and URI respectively. - """ - # FIXME: Unroll defgen - - # Look for X-Authorize-As Header - authz = request.headers.getRawHeaders("x-authorize-as") - - if authz is not None and (len(authz) == 1): - # Substitute the authz value for principal look up - authz = authz[0] - - def getPrincipalForType(type, name): - for collection in self.principalCollections(): - principal = collection.principalForShortName(type, name) - if principal: - return principal - - def isSudoPrincipal(authid): - if getPrincipalForType(SudoDirectoryService.recordType_sudoers, - authid): - return True - return False - - if isSudoPrincipal(authid): - if authz: - if isSudoPrincipal(authz): - log.msg("Cannot proxy as another proxy: user '%s' as user '%s'" % (authid, authz)) - raise HTTPError(responsecode.FORBIDDEN) - else: - authzPrincipal = getPrincipalForType( - DirectoryService.recordType_groups, authz) - - if not authzPrincipal: - authzPrincipal = self.findPrincipalForAuthID(authz) - - if authzPrincipal is not None: - log.msg("Allow proxy: user '%s' as '%s'" % (authid, authz,)) - yield authzPrincipal - return - else: - log.msg("Could not find authorization user id: '%s'" % - (authz,)) - raise HTTPError(responsecode.FORBIDDEN) - else: - log.msg("Cannot authenticate proxy user '%s' without X-Authorize-As header" % (authid, )) - raise HTTPError(responsecode.BAD_REQUEST) - elif authz: - log.msg("Cannot proxy: user '%s' as '%s'" % (authid, authz,)) - raise HTTPError(responsecode.FORBIDDEN) - else: - # No proxy - do default behavior - d = waitForDeferred(super(CalDAVResource, self).authorizationPrincipal(request, authid, authnPrincipal)) - yield d - yield d.getResult() - return - - authorizationPrincipal = deferredGenerator(authorizationPrincipal) - ## # CalDAV ##

1 0