XrdAccRules Class Reference

Collaboration diagram for XrdAccRules:

Public Member Functions
	XrdAccRules (uint64_t expiry_time, const std::string &username, const std::string &token_subject, const std::string &issuer, const std::vector< MapRule > &rules, const std::vector< std::string > &groups, uint32_t authz_strategy)
	~XrdAccRules ()
bool	apply (Access_Operation oper, std::string path)
bool	expired () const
uint32_t	get_authz_strategy () const
const std::string &	get_default_username () const
const std::string &	get_issuer () const
const std::string &	get_token_subject () const
std::string	get_username (const std::string &req_path) const
const std::vector< std::string > &	groups () const
void	parse (const AccessRulesRaw &rules)
size_t	size () const
const std::string	str () const

Detailed Description

Definition at line 369 of file XrdSciTokensAccess.cc.

Constructor & Destructor Documentation

XrdAccRules()

XrdAccRules::XrdAccRules ( uint64_t expiry_time, const std::string & username, const std::string & token_subject, const std::string & issuer, const std::vector< MapRule > & rules, const std::vector< std::string > & groups, uint32_t authz_strategy )

inline

Definition at line 372 of file XrdSciTokensAccess.cc.

                                 :
        m_authz_strategy(authz_strategy),
        m_expiry_time(expiry_time),
        m_username(username),
        m_token_subject(token_subject),
        m_issuer(issuer),
        m_map_rules(rules),
        m_groups(groups)
    {}

References groups().

Here is the call graph for this function:

~XrdAccRules()

XrdAccRules::~XrdAccRules ( )

inline

Definition at line 384 of file XrdSciTokensAccess.cc.

{}

Member Function Documentation

apply()

bool XrdAccRules::apply ( Access_Operation oper, std::string path )

inline

Definition at line 386 of file XrdSciTokensAccess.cc.

                                                      {
      for (const auto & rule : m_rules) {
        // Skip rules that don't match the current operation
        if (rule.first != oper)
          continue;
 
        // If the rule allows any path, allow the operation
        if (rule.second == "/")
          return true;
 
        // Allow operation if path is a subdirectory of the rule's path
        if (is_subdirectory(rule.second, path)) {
          return true;
        } else {
          // Allow stat and mkdir of parent directories to comply with WLCG token specs
          if (oper == AOP_Stat || oper == AOP_Mkdir)
            if (is_subdirectory(path, rule.second))
              return true;
        }
      }
      return false;
    }

References AOP_Mkdir, AOP_Stat, and is_subdirectory().

Here is the call graph for this function:

expired()

bool XrdAccRules::expired ( ) const

inline

Definition at line 409 of file XrdSciTokensAccess.cc.

{return monotonic_time() > m_expiry_time;}

get_authz_strategy()

uint32_t XrdAccRules::get_authz_strategy ( ) const

inline

Definition at line 456 of file XrdSciTokensAccess.cc.

{return m_authz_strategy;}

get_default_username()

const std::string & XrdAccRules::get_default_username ( ) const

inline

Definition at line 453 of file XrdSciTokensAccess.cc.

{return m_username;}

get_issuer()

const std::string & XrdAccRules::get_issuer ( ) const

inline

Definition at line 454 of file XrdSciTokensAccess.cc.

{return m_issuer;}

get_token_subject()

const std::string & XrdAccRules::get_token_subject ( ) const

inline

Definition at line 452 of file XrdSciTokensAccess.cc.

{return m_token_subject;}

get_username()

std::string XrdAccRules::get_username ( const std::string & req_path ) const

inline

Definition at line 418 of file XrdSciTokensAccess.cc.

    {
        for (const auto &rule : m_map_rules) {
            std::string name = rule.match(m_token_subject, m_username, req_path, m_groups);
            if (!name.empty()) {
                return name;
            }
        }
        return "";
    }

groups()

const std::vector< std::string > & XrdAccRules::groups ( ) const

inline

Definition at line 459 of file XrdSciTokensAccess.cc.

{return m_groups;}

Referenced by XrdAccRules().

Here is the caller graph for this function:

parse()

void XrdAccRules::parse ( const AccessRulesRaw & rules )

inline

Definition at line 411 of file XrdSciTokensAccess.cc.

                                            {
        m_rules.reserve(rules.size());
        for (const auto &entry : rules) {
            m_rules.emplace_back(entry.first, entry.second);
        }
    }

size()

size_t XrdAccRules::size ( ) const

inline

Definition at line 458 of file XrdSciTokensAccess.cc.

{return m_rules.size();}

str()

const std::string XrdAccRules::str ( ) const

inline

Definition at line 429 of file XrdSciTokensAccess.cc.

    {
        std::stringstream ss;
        ss << "mapped_username=" << m_username << ", subject=" << m_token_subject
           << ", issuer=" << m_issuer;
        if (!m_groups.empty()) {
            ss << ", groups=";
            bool first=true;
            for (const auto &group : m_groups) {
                ss << (first ? "" : ",") << group;
                first = false;
            }
        }
        if (!m_rules.empty()) {
            ss << ", authorizations=" << AccessRuleStr(m_rules);
        }
        return ss.str();
    }

---

The documentation for this class was generated from the following file:

• XrdSciTokensAccess.cc