source: TI05-delivery/ows_framework/trunk/ows_server/ows_server/models/ndgSecurity.py @ 2775

from ows_common.exception_report import OwsError
from pylons import request
from ndg.security.common.SessionMgr import SessionMgrClient, \
    AttributeRequestDenied

def HandleSecurity(securityElement, securityTokens):
    return SecurityHandler(securityElement, securityTokens)()

# This is an initial implementation and is untested.  See TODOs
# for more info
#
# P J Kershaw 26/07/07
class SecurityHandler(object):
    """Make access control decision based on CSML constraint and user security
    token"""
    
    AccessAllowedMsg = "Access Allowed"
    AccessDeniedMsg = "Access Denied"
    NotLoggedInMsg = 'Not Logged in'
    
    def __init__(self, securityElement, securityTokens):
        """Initialise settings for WS-Security and SSL for SOAP
        call to Session Manager
        
        @type: ? TODO: set type
        @param securityElement: CSML security constraint containing role and
        Attribute Authority URI
        
        @type: pylons.session
        @param securityTokens: dict-like session object containing security 
        tokens"""
        
        self.securityElement = securityElement
        self.securityTokens = securityTokens
        
        # TODO: fix this ref.
        self.ndgCfg = request.environ['ndgConfig']

        self.tracefile = eval(self.ndgCfg.get('NDG_SECURITY','tracefile'))
        
        # ... for SSL connections to security web services
        try:
            self.sslCACertFilePathList = \
            self.ndgCfg.get('NDG_SECURITY','sslCACertFilePathList').split()
                
        except AttributeError:
            raise OwsError, 'No "sslCACertFilePathList" security setting'

        self.sslPeerCertCN = self.ndgCfg.get('NDG_SECURITY', 'sslPeerCertCN')

        # ...and for WS-Security digital signature
        self.wssCertFilePath = self.ndgCfg.get('NDG_SECURITY', 
                                               'wssCertFilePath')
        self.wssPriKeyFilePath = self.ndgCfg.get('NDG_SECURITY', 
                                                 'wssKeyFilePath')
        self.wssPriKeyPwd = self.ndgCfg.get('NDG_SECURITY', 'wssKeyPwd')

        try:
            self.wssCACertFilePathList = \
            self.ndgCfg.get('NDG_SECURITY', 'wssCACertFilePathList').split()
                
        except AttributeError:
            raise OwsError, 'No "wssCACertFilePathList" security setting'

        # Attribute Certificate verification of X.509 cert chain back to CA
        try:
            self.acCACertFilePathList = \
            self.ndgCfg.get('NDG_SECURITY', 'acCACertFilePathList').split()
                
        except AttributeError:
            raise OwsError, 'No "wssCACertFilePathList" security setting'

        # Create Session Manager client
        self.smClnt = SessionMgrClient(uri=self.securityTokens['smURI'],
                        sslCACertFilePathList=self.sslCACertFilePathList,
                        sslPeerCertCN=self.sslPeerCertCN,
                        signingCertChain=securityTokens.get('wssCertChain'),
                        signingCertFilePath=self.wssCertFilePath,
                        signingPriKeyFilePath=self.wssPriKeyFilePath,
                        signingPriKeyPwd=self.wssPriKeyPwd,
                        caCertFilePathList=self.wssCACertFilePathList,
                        tracefile=self.tracefile)       

        # Fix WS-Security BinarySecurityToken Value Type for the passing of a 
        # cert chain - required for use with proxy cert.
        if wssCertChain:
            self.smClnt.signatureHandler.reqBinSecTokValType = 'X509PKIPathv1'


    def __call__(self, **kw):
        """Convenience wrapper for checAccess"""
        return self.checkAccess(**kw)


    def checkAccess(self, securityElement=None, securityTokens=None):
        """Make an access control decision based on whether the user is
        authenticated and has the required roles
        
        @type: ? TODO: set type
        @keyword securityElement: CSML security constraint containing role and
        Attribute Authority URI.  Resets equivalent object attribute.
        
        @type: pylons.session
        @keyword securityTokens: dict-like session object containing security 
        tokens.  Resets equivalent object attribute."""
     
        if securityElement:
            self.securityElement = securityElement
            
        if securityTokens:
            self.securityTokens = securityTokens
             
        if self.securityTokens is not None:
            return self.__checkAttCert()
        else:
            return False, self.__class__.NotLoggedInMsg

   
    def __checkAttCert(self):
        """Check to see if the Session Manager can deliver an Attribute 
        Certificate with the required role to gain access to the resource
        in question"""
        
        try:
            # Get the Attribute Authority address for the Session Manager to
            # send its attribute request to
            #
            # # TODO: get the correct AA URI attribute name
            aaURI = self.securityElement.aaURI 

            # Make request for attribute certificate
            #
            # sessID is needed if proxy cert is unavailable as ID
            #
            # TODO: get correct role name attribute from securityElement var
            attCert = self.smClnt.getAttCert(attAuthorityURI=aaURI,
                                     sessID=self.securityToken.get('sessID'),
                                     reqRole=self.securityElement.roleName)

        except AttributeRequestDenied, e:
            # TODO: write exception to log
            return False, self.__class__.AccessDeniedMsg
        
        # Check attribute certificate is valid
        attCert.certFilePathList = self.acCACertFilePathList
        attCert.isValid(raiseExcep=True)
            
        # Check it's issuer is as expected
        if attCert.issuerName != self.acIssuerName:
            raise OwsError, "Attribute Certificate issuer must match " + \
                "this data provider's Attribute Authority name id"
                       
        return True, self.__class__.AccessAllowedMsg