lcmaps_voms_poolaccount.c

Go to the documentation of this file.

/*                                                                                                            
 * Copyright (c) Members of the EGEE Collaboration. 2004.
 * See http://eu-egee.org/partners/ for details on the copyright holders.
 * For license conditions see the license file or
 * http://eu-egee.org/license.html
 */

/*
 * Copyright (c) 2001 EU DataGrid.
 * For license conditions see http://www.eu-datagrid.org/license.html
 *
 * Copyright (c) 2001, 2002 by
 *     Martijn Steenbakkers <martijn@nikhef.nl>,
 *     David Groep <davidg@nikhef.nl>,
 *     NIKHEF Amsterdam, the Netherlands
 */

/*****************************************************************************
                            Include header files
******************************************************************************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <pwd.h>

#include "lcmaps_config.h"
#include "lcmaps_modules.h"
#include "lcmaps_arguments.h"
#include "lcmaps_cred_data.h"
#include "lcmaps_gridlist.h"

/******************************************************************************
                                Definitions
******************************************************************************/
#define LCMAPS_MAXGIDBUFFER 256

/******************************************************************************
                          Module specific prototypes
******************************************************************************/

/******************************************************************************
                       Define module specific variables
******************************************************************************/

static char *gridmapfile         = NULL;
static char *gridmapdir          = NULL;
static int   require_primary_gid = 1;
static int   use_secondary_gids  = 1;
static int   override_inconsistency = 0; 

/******************************************************************************
Function:   plugin_initialize
Description:
    Initialize plugin
Parameters:
    argc, argv
    argv[0]: the name of the plugin
Returns:
    LCMAPS_MOD_SUCCESS : succes
    LCMAPS_MOD_FAIL    : failure
    LCMAPS_MOD_NOFILE  : db file not found (will halt LCMAPS initialization)
******************************************************************************/
int plugin_initialize(
        int argc,
        char ** argv
)
{
    char *  logstr = "\tlcmaps_plugin_voms_poolaccount-plugin_initialize()";
    int i;

    lcmaps_log_debug(1,"%s: passed arguments:\n", logstr);
    for (i=0; i < argc; i++)
    {
       lcmaps_log_debug(2,"%s: arg %d is %s\n", logstr, i, argv[i]);
    }

    /*
     * the first will be the thing to edit/select (gridmap(file))
     * the second will be the path && filename of the gridmapfile
     */

    /*
     * Parse arguments, argv[0] = name of plugin, so start with i = 1
     */
    for (i = 1; i < argc; i++)
    {
        if ( ((strcmp(argv[i], "-gridmap") == 0) ||
              (strcmp(argv[i], "-GRIDMAP") == 0) ||
              (strcmp(argv[i], "-gridmapfile") == 0) ||
              (strcmp(argv[i], "-GRIDMAPFILE") == 0))
             && (i + 1 < argc))
        {
            if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
            {
                 gridmapfile = strdup(argv[i + 1]);
            }
            i++;
        }
        else if ( ((strcmp(argv[i], "-gridmapdir") == 0) ||
              (strcmp(argv[i], "-GRIDMAPDIR") == 0))
             && (i + 1 < argc))
        {
            if ((argv[i + 1] != NULL) && (strlen(argv[i + 1]) > 0))
            {
                 gridmapdir = strdup(argv[i + 1]);
            }
            i++;
        }
        else if (strcmp(argv[i], "-do_not_use_secondary_gids") == 0)
        {
            use_secondary_gids = 0;
        }
        else if (strcmp(argv[i], "-do_not_require_primary_gid") == 0)
        {
            require_primary_gid = 0;
        }
        else if ( (strcmp(argv[i], "-override_inconsistency") == 0) ||
                  (strcmp(argv[i], "-OVERRIDE_INCONSISTENCY") == 0))
        {
            override_inconsistency = 1;
        }
        else
        {
            lcmaps_log(0,"%s: Error in initialization parameter: %s (failure)\n", logstr,
                       argv[i]);
            return LCMAPS_MOD_FAIL;
        }
    }

    if ( (use_secondary_gids == 0) && (require_primary_gid == 0) )
    {
        lcmaps_log(0,"%s: Conflicting voms_poolaccount options: \"-do_not_use_secondary_gids\" and \"-do_not_require_primary_gid\" (failure)\n", logstr);
        return LCMAPS_MOD_FAIL;
    }

    return LCMAPS_MOD_SUCCESS;
} 

/******************************************************************************
Function:   plugin_introspect
Description:
    return list of required arguments
Parameters:

Returns:
    LCMAPS_MOD_SUCCESS : succes
    LCMAPS_MOD_FAIL    : failure
******************************************************************************/
int plugin_introspect(
        int * argc,
        lcmaps_argument_t ** argv
)
{
    char *                   logstr = "\tlcmaps_plugin_voms_poolaccount-plugin_introspect()";
    static lcmaps_argument_t argList[] = {
        {"user_dn"      ,       "char *"        , 0,   NULL},
        {"fqan_list"    ,       "char **"       , 0,   NULL},
        {"nfqan"        ,       "int"           , 0,   NULL},
        {NULL           ,       NULL            , -1,   NULL}
    };

    lcmaps_log_debug(1,"%s: introspecting\n", logstr);

    *argv = argList;
    *argc = lcmaps_cntArgs(argList);
    lcmaps_log_debug(1,"%s: address first argument: 0x%x\n", logstr, argList);

    return LCMAPS_MOD_SUCCESS;
}


/******************************************************************************
Function:   plugin_run
Description:
    Gather credentials for LCMAPS
Parameters:
    argc: number of arguments
    argv: list of arguments
Returns:
    LCMAPS_MOD_SUCCESS: authorization succeeded
    LCMAPS_MOD_FAIL   : authorization failed
******************************************************************************/
int plugin_run(
        int argc,
        lcmaps_argument_t * argv
)
{
    char *              logstr = "\tlcmaps_plugin_voms_poolaccount-plugin_run()";
    char *              dn                  = NULL; 
    char *              groupname           = NULL;
    struct group        *group_info         = NULL;
    char *              username            = NULL;
    struct passwd       *user_info          = NULL;
    int                 i                   = 0;
    int                 cnt_pri_gid         = 0;
    gid_t *             pri_gid             = NULL;
    int                 cnt_sec_gid         = 0;
    gid_t *             sec_gid             = NULL;
    char *              gidstring           = NULL;
    char                gidbuffer[LCMAPS_MAXGIDBUFFER];
    int                 index               = 0;
    char **             vo_cred_string_list = NULL;
    int                 cnt_vo_cred_string  = 0;
    int                 found               = 0;
    char *              leasename           = NULL;
    int                 leasenamelen        = 0;
    unsigned short      matching_type       = ((unsigned short)0x0000);
    int                 rc                  = 0;
    char **             fqan_list           = NULL;
    int                 nfqan               = -1;
    
    /*
     * The beginning
     */
    lcmaps_log_debug(1,"%s:\n", logstr);

    /*
     * Try to get the ordered values:
     */
    if ( ( dn = *(char **) lcmaps_getArgValue("user_dn", "char *", argc, argv) ) )
        lcmaps_log_debug(1,"%s: found dn: %s\n", logstr, dn);
    else
        lcmaps_log_debug(1,"%s: could not get value of dn !\n", logstr);


    /*
     * Check the gridmapfile
     */

    if ((gridmapfile != NULL) && (strlen(gridmapfile) > 0))
        lcmaps_log_debug(1,"%s: gridmapfile is: %s\n", logstr, gridmapfile);
    else
    {
        if (gridmapfile) free(gridmapfile);
        gridmapfile = NULL;
        lcmaps_log_debug(1,"%s: No gridmapfile assigned, so function must find out for it self\n", logstr);
    }

    /*
     * Check gridmapdir
     */
    if (gridmapdir == NULL) /* try if GRIDMAPDIR is already set */
    {
        char * tmpptr=NULL;
        if ((tmpptr = getenv("GRIDMAPDIR")) == NULL)
        {
            lcmaps_log(0,"%s: GRIDMAPDIR unknown !\n", logstr);
            lcmaps_log(0,"%s:  specify as option or set GRIDMAPDIR\n", logstr);
            goto fail_voms_poolaccount;
        }
        else
        {
            gridmapdir = strdup(tmpptr);
        }
    }
    if (strlen(gridmapdir) == 0)
    {
        lcmaps_log(0,"%s: cannot set MAPDIR (strlen(gridmapdir) == 0)\n", logstr);
        goto fail_voms_poolaccount;
    }
    lcmaps_log_debug(1,"%s: setting MAPDIR to %s\n", logstr, gridmapdir);
    if (setenv("MAPDIR", gridmapdir, 1))
    {
        lcmaps_log(0,"%s: cannot set MAPDIR\n", logstr);
        goto fail_voms_poolaccount;
    }

    /*
     * Get the (VOMS) gids found so far and build a string out of it.
     * First primary Gid(s), behind it the secondary Gids.
     * For the moment, the same order is taken as found in the VOMS credential.
     * We might consider to sort the gids.
     * We cannot order them by lcmaps_argument_t, but have to use the getCredentialData() function
     * since it was stored there by a plugin (lcmaps_voms.mod)
     */
    pri_gid = (gid_t *)getCredentialData(PRI_GID, &cnt_pri_gid);
    if (cnt_pri_gid == 0)
    {
        lcmaps_log(0,"%s: warning: no primary group found ! \n", logstr);
    }
    else if (cnt_pri_gid < 0)
    {
        lcmaps_log(0,"%s: negative number of primary groups found ! (failure)\n", logstr);
        goto fail_voms_poolaccount;
    }
    else if (cnt_pri_gid > 1)
    {
        lcmaps_log(0,"%s: warning more than 1 primary group found\n", logstr);
    }
    if ( (require_primary_gid == 1) && (cnt_pri_gid < 1) )
    {
        lcmaps_log(0,"%s: no primary group found (failure)\n", logstr);
        goto fail_voms_poolaccount;
    }

    sec_gid = (gid_t *)getCredentialData(SEC_GID, &cnt_sec_gid);
    if (cnt_sec_gid < 0)
    {
        lcmaps_log(0,"%s: negative number of secondary groups found ! (failure)\n", logstr);
        goto fail_voms_poolaccount;
    }
    /*
     * Cat the gids into a string
     */
    gidbuffer[0] = '\0';
    index = 0;
    /* First the primary gids */
    for (i = 0; i < cnt_pri_gid; i++)
    {
        if ( ( group_info = getgrgid(pri_gid[i]) ) )
        {
            groupname = group_info->gr_name;
            if ( (strlen(groupname) + 1) < (LCMAPS_MAXGIDBUFFER - index) )
            {
                strncat(gidbuffer, ":", 1);
                strncat(gidbuffer, groupname, (LCMAPS_MAXGIDBUFFER - index - 2));
                index += strlen(groupname) + 1;
                lcmaps_log_debug(1,"%s: primary groups, i=%d(%d), group_info->gr_name: %s\n", logstr,
                                 i,cnt_pri_gid,group_info->gr_name);
                lcmaps_log_debug(1,"%s: gidbuffer: %s\n", logstr,gidbuffer);
            }
            else
            {
                lcmaps_log(0,"%s: gidbuffer is full (%d bytes) (failure)\n", logstr,
                           LCMAPS_MAXGIDBUFFER);
                goto fail_voms_poolaccount;
            }
        }
        else
        {
            lcmaps_log(0,"%s: no group id found for groupname = \"%s\"\n", logstr, groupname);
            goto fail_voms_poolaccount;
        }
    }
    /* Then the secondary gids, but only if use_secondary_gids == 1 */
    if (use_secondary_gids)
    {
        for (i = 0; i < cnt_sec_gid; i++)
        {
            if ( ( group_info = getgrgid(sec_gid[i]) ) )
            {
                groupname = group_info->gr_name;
                if ( (strlen(groupname) + 1) < (LCMAPS_MAXGIDBUFFER - index) )
                {
                    strncat(gidbuffer, ":", 1);
                    strncat(gidbuffer, groupname, (LCMAPS_MAXGIDBUFFER - index - 2));
                    index += strlen(groupname) + 1;
                    lcmaps_log_debug(1,"%s: secondary groups, i=%d(%d), group_info->gr_name: %s\n", logstr,
                                     i,cnt_sec_gid,group_info->gr_name);
                    lcmaps_log_debug(1,"%s: gidbuffer: %s\n", logstr,gidbuffer);
                }
                else
                {
                    lcmaps_log(0,"%s: gidbuffer is full (%d bytes) (failure)\n", logstr,
                               LCMAPS_MAXGIDBUFFER);
                    goto fail_voms_poolaccount;
                }
            }
            else
            {
                lcmaps_log_debug(1,"%s: no group id found for groupname = \"%s\"\n", logstr, groupname);
                goto fail_voms_poolaccount;
            }
        }
    }
    if (gidbuffer[0] == '\0')
    {
        gidstring = NULL;
        leasenamelen = strlen(dn) + 1;
        leasename = strdup(dn);
    }
    else
    {
        gidstring = gidbuffer;
        leasenamelen = strlen(dn) + strlen(gidstring) + 1;
        leasename = malloc(leasenamelen*sizeof(char));
        snprintf(leasename, leasenamelen, "%s%s", dn, gidstring);
    }

    /*
     * Get the VO user information.
     * We can either order it by lcmaps_argument_t or use the getCredentialData() function.
     * The latter case requires the voms parsing plugin (lcmaps_voms.mod) to have run beforehand.
     * Unfortunately the formats of the VOMS strings (from getCredentialData()) and
     * FQANs (from lcmaps_argument_t) are not the same. We may have to introduce
     * two-way conversion functions.
     * The VOMS info has to matched against the info in the gridmapfile
     */
    lcmaps_log_debug(1,"%s: First try to get the FQAN list from input credential repository ...\n", logstr);
    if ( ( nfqan = *(int *) lcmaps_getArgValue("nfqan", "int", argc, argv) ) )
    {
        lcmaps_log_debug(1,"%s: the list of FQANs should contain %d elements\n", logstr, nfqan);
        if ( ( fqan_list = *(char ***) lcmaps_getArgValue("fqan_list", "char **", argc, argv) ) )
            lcmaps_log_debug(1, "%s: found list of FQANs\n", logstr);
        else
        {
            lcmaps_log_debug(1, "%s: could not retrieve list of FQANs (failure)!\n", logstr);
            goto fail_voms_poolaccount;
        }
        for (i = 0; i < nfqan; i++)
        {
            lcmaps_log_debug(3, "%s: FQAN %d: %s\n", logstr, i, fqan_list[i]);
        }
        vo_cred_string_list = fqan_list;
        cnt_vo_cred_string = nfqan;
    }
    else
    {
        lcmaps_log_debug(1,"%s: ... did not find input credentials in input credential repository...\n", logstr);
        lcmaps_log_debug(1,"%s: ... trying the internal credential repository ...\n", logstr);

        vo_cred_string_list = getCredentialData(LCMAPS_VO_CRED_STRING, &cnt_vo_cred_string);
    }

    if (cnt_vo_cred_string == 0)
    {
        lcmaps_log(0,"%s: no VOMS group info --> no mapping (failure)\n", logstr);
        goto fail_voms_poolaccount;
    }
    else if (cnt_vo_cred_string < 0)
    {
        lcmaps_log(0,"%s: negative number of VOMS groups found ! (failure)\n", logstr);
        goto fail_voms_poolaccount;
    }


    /*
     * Try to match the VO strings with the gridmapfile info
     * normally the first available VO string should match
     */
    found = 0;
    lcmaps_log_debug(2,"%s: using leasename: %s\n", logstr,leasename);

    matching_type = MATCH_INCLUDE|MATCH_WILD_CHARS;
 
    /* if override_consistency is set add this to the matchin_type so it will take effect */
    if (override_inconsistency)
        matching_type = matching_type|OVERRIDE_INCONSISTANCY;

    for (i = 0; i < cnt_vo_cred_string; i++)
    {
        if ( (i > 0) && (require_primary_gid == 1) )
        {
            lcmaps_log(0,"%s: no match (or no poolaccount available) for primary group (%s) in %s (failure)\n", logstr,
                       vo_cred_string_list[0], gridmapfile);
            goto fail_voms_poolaccount;
        }


        if ( (rc = lcmaps_gridlist(vo_cred_string_list[i], &username, gridmapfile, matching_type, ".", leasename)) == 0)
        {
            found = 1;
            lcmaps_log_debug(1,"%s: found username: %s\n", logstr, username);
            break;
        }
        else if (rc == LCMAPS_MOD_NOFILE)
        {
            lcmaps_log(0, "%s: Could not find the gridmapfile %s\n", logstr, gridmapfile);
            goto fail_voms_poolaccount;
        }
        else
        {
            lcmaps_log(0, "%s: no match (or no poolaccount available) for group (%s) in %s\n", logstr, vo_cred_string_list[i], gridmapfile);
        }
    }


    /*
     * Get userid to pwd_t structure
     */
    if (username && (strlen(username) > 0))
    {

        if ( ( user_info = getpwnam(username) ) )
        {
            char *  encoded_lease = NULL;

            lcmaps_log_debug(2,"%s: address user_info: %p\n", logstr, user_info);
            lcmaps_log_debug(2,"%s: username : %s, char ptr: %p, address char ptr: %p\n", logstr, user_info->pw_name, user_info->pw_name, &(user_info->pw_name));
            lcmaps_log_debug(2,"%s: password : %s\n", logstr, user_info->pw_passwd);
            lcmaps_log_debug(2,"%s: user_id  : %d, address uid: %p\n", logstr, user_info->pw_uid, &(user_info->pw_uid));
            lcmaps_log_debug(2,"%s: group_id : %d\n", logstr, user_info->pw_gid);
            lcmaps_log_debug(2,"%s: realname : %s\n", logstr, user_info->pw_gecos);
            lcmaps_log_debug(2,"%s: home dir : %s\n", logstr, user_info->pw_dir);
            lcmaps_log_debug(2,"%s: shellprg : %s\n", logstr, user_info->pw_shell);

            /* 
             * Add this credential data to the credential data repository in the plugin manager
             */
            addCredentialData(DN,  &dn);
            addCredentialData(UID, &(user_info->pw_uid));

            /* Added because of the POOL_INDEX request for the DAS */
            encoded_lease = gridmapdir_urlencode(leasename);
            addCredentialData(POOL_INDEX, &encoded_lease);
            if (encoded_lease)
            {
                free(encoded_lease);
                encoded_lease = NULL;
            }
        }
        else
        {
            lcmaps_log(0,"%s: no user account found name \"%s\"\n", logstr, username);
            goto fail_voms_poolaccount;
        }
    }
    else
    {   // error (msg is already given)
        goto fail_voms_poolaccount;
    }

    /* succes */
 success_voms_poolaccount:
    if (username) free(username);
    lcmaps_log_time(0,"%s: voms_poolaccount plugin succeeded\n", logstr);
    return LCMAPS_MOD_SUCCESS;

 fail_voms_poolaccount:
    if (username) free(username);
    lcmaps_log_time(0,"%s: voms_poolaccount plugin failed\n", logstr);
    return LCMAPS_MOD_FAIL;
}

/******************************************************************************
Function:   plugin_terminate
Description:
    Terminate plugin
Parameters:

Returns:
    LCMAPS_MOD_SUCCESS : succes
    LCMAPS_MOD_FAIL    : failure
******************************************************************************/
int plugin_terminate()
{
    char * logstr = "\tlcmaps_plugin_voms_poolaccount-plugin_terminate()";

    lcmaps_log_debug(1,"%s: terminating\n", logstr);

    if (gridmapfile) free(gridmapfile);
    if (gridmapdir) free(gridmapdir);

    return LCMAPS_MOD_SUCCESS;
}

/******************************************************************************
CVS Information:
    $Source: /cvs/jra1mw/org.glite.security.lcmaps-plugins-voms/src/voms/lcmaps_voms_poolaccount.c,v $
    $Date: 2005/02/27 01:30:42 $
    $Revision: 1.6 $
    $Author: msteenba $
******************************************************************************/

---