XRootD
XrdAccRules Class Reference
+ Collaboration diagram for XrdAccRules:

Public Member Functions

 XrdAccRules (uint64_t expiry_time, const std::string &username, const std::string &token_subject, const std::string &issuer, const std::vector< MapRule > &rules, const std::vector< std::string > &groups, uint32_t authz_strategy)
 
 ~XrdAccRules ()
 
bool apply (Access_Operation oper, std::string path)
 
bool expired () const
 
uint32_t get_authz_strategy () const
 
const std::string & get_default_username () const
 
const std::string & get_issuer () const
 
const std::string & get_token_subject () const
 
std::string get_username (const std::string &req_path) const
 
const std::vector< std::string > & groups () const
 
void parse (const AccessRulesRaw &rules)
 
size_t size () const
 
const std::string str () const
 

Detailed Description

Definition at line 349 of file XrdSciTokensAccess.cc.

Constructor & Destructor Documentation

◆ XrdAccRules()

XrdAccRules::XrdAccRules ( uint64_t  expiry_time,
const std::string &  username,
const std::string &  token_subject,
const std::string &  issuer,
const std::vector< MapRule > &  rules,
const std::vector< std::string > &  groups,
uint32_t  authz_strategy 
)
inline

Definition at line 352 of file XrdSciTokensAccess.cc.

354  :
355  m_authz_strategy(authz_strategy),
356  m_expiry_time(expiry_time),
357  m_username(username),
358  m_token_subject(token_subject),
359  m_issuer(issuer),
360  m_map_rules(rules),
361  m_groups(groups)
362  {}
const std::vector< std::string > & groups() const

◆ ~XrdAccRules()

XrdAccRules::~XrdAccRules ( )
inline

Definition at line 364 of file XrdSciTokensAccess.cc.

364 {}

Member Function Documentation

◆ apply()

bool XrdAccRules::apply ( Access_Operation  oper,
std::string  path 
)
inline

Definition at line 366 of file XrdSciTokensAccess.cc.

366  {
367  auto is_subdirectory = [](const std::string& dir, const std::string& subdir) {
368  if (subdir.size() < dir.size())
369  return false;
370 
371  if (subdir.compare(0, dir.size(), dir, 0, dir.size()) != 0)
372  return false;
373 
374  return dir.size() == subdir.size() || subdir[dir.size()] == '/' || dir == "/";
375  };
376 
377  for (const auto & rule : m_rules) {
378  // Skip rules that don't match the current operation
379  if (rule.first != oper)
380  continue;
381 
382  // If the rule allows any path, allow the operation
383  if (rule.second == "/")
384  return true;
385 
386  // Allow operation if path is a subdirectory of the rule's path
387  if (is_subdirectory(rule.second, path)) {
388  return true;
389  } else {
390  // Allow stat and mkdir of parent directories to comply with WLCG token specs
391  if (oper == AOP_Stat || oper == AOP_Mkdir)
392  if (is_subdirectory(path, rule.second))
393  return true;
394  }
395  }
396  return false;
397  }
@ AOP_Mkdir
mkdir()
@ AOP_Stat
exists(), stat()

References AOP_Mkdir, and AOP_Stat.

◆ expired()

bool XrdAccRules::expired ( ) const
inline

Definition at line 399 of file XrdSciTokensAccess.cc.

399 {return monotonic_time() > m_expiry_time;}

◆ get_authz_strategy()

uint32_t XrdAccRules::get_authz_strategy ( ) const
inline

Definition at line 446 of file XrdSciTokensAccess.cc.

446 {return m_authz_strategy;}

◆ get_default_username()

const std::string& XrdAccRules::get_default_username ( ) const
inline

Definition at line 443 of file XrdSciTokensAccess.cc.

443 {return m_username;}

◆ get_issuer()

const std::string& XrdAccRules::get_issuer ( ) const
inline

Definition at line 444 of file XrdSciTokensAccess.cc.

444 {return m_issuer;}

◆ get_token_subject()

const std::string& XrdAccRules::get_token_subject ( ) const
inline

Definition at line 442 of file XrdSciTokensAccess.cc.

442 {return m_token_subject;}

◆ get_username()

std::string XrdAccRules::get_username ( const std::string &  req_path) const
inline

Definition at line 408 of file XrdSciTokensAccess.cc.

409  {
410  for (const auto &rule : m_map_rules) {
411  std::string name = rule.match(m_token_subject, m_username, req_path, m_groups);
412  if (!name.empty()) {
413  return name;
414  }
415  }
416  return "";
417  }

◆ groups()

const std::vector<std::string>& XrdAccRules::groups ( ) const
inline

Definition at line 449 of file XrdSciTokensAccess.cc.

449 {return m_groups;}

◆ parse()

void XrdAccRules::parse ( const AccessRulesRaw &  rules)
inline

Definition at line 401 of file XrdSciTokensAccess.cc.

401  {
402  m_rules.reserve(rules.size());
403  for (const auto &entry : rules) {
404  m_rules.emplace_back(entry.first, entry.second);
405  }
406  }

◆ size()

size_t XrdAccRules::size ( ) const
inline

Definition at line 448 of file XrdSciTokensAccess.cc.

448 {return m_rules.size();}

◆ str()

const std::string XrdAccRules::str ( ) const
inline

Definition at line 419 of file XrdSciTokensAccess.cc.

420  {
421  std::stringstream ss;
422  ss << "mapped_username=" << m_username << ", subject=" << m_token_subject
423  << ", issuer=" << m_issuer;
424  if (!m_groups.empty()) {
425  ss << ", groups=";
426  bool first=true;
427  for (const auto &group : m_groups) {
428  ss << (first ? "" : ",") << group;
429  first = false;
430  }
431  }
432  if (!m_rules.empty()) {
433  ss << ", authorizations=" << AccessRuleStr(m_rules);
434  }
435  return ss.str();
436  }

The documentation for this class was generated from the following file: