lcas_userallow.c

Go to the documentation of this file.

/*                                                                                                            
 * Copyright (c) Members of the EGEE Collaboration. 2004.
 * See http://eu-egee.org/partners/ for details on the copyright holders.
 * For license conditions see the license file or
 * http://eu-egee.org/license.html
 */

/*                                                                                                            
 * Copyright (c) 2001 EU DataGrid.                                                                             
 * For license conditions see http://www.eu-datagrid.org/license.html                                          
 *
 * Copyright (c) 2001, 2002 by 
 *     Martijn Steenbakkers <martijn@nikhef.nl>,
 *     David Groep <davidg@nikhef.nl>,
 *     NIKHEF Amsterdam, the Netherlands
 */

/******************************************************************************

lcas_userallow.c

Description:
    LCAS module that does static user checking
    Currently it uses the gridmapfile

CVS Information:
    $Source: /cvs/jra1mw/org.glite.security.lcas-plugins-basic/src/userallow/lcas_userallow.c,v $
    $Date: 2005/02/28 11:45:52 $
    $Revision: 1.3 $
    $Author: msteenba $

******************************************************************************/

/*****************************************************************************
                            Include header files
******************************************************************************/
#include "lcas_config.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#if HAVE_MALLOC_H
#include <malloc.h>
#endif

#include "lcas_modules.h"
#include "lcas_gridlist.h"

/******************************************************************************
                                Definitions
******************************************************************************/

#define USE_GRIDMAP 1

/******************************************************************************
                       Define module specific variables
******************************************************************************/
static char *                 modname="lcas_userallow.mod";
static char *                 userallow_db = NULL;

/******************************************************************************
Function:   plugin_initialize
Description:
    Initialize plugin
Parameters:
    argc, argv
    argv[1]: database to be used by plugin
Returns:
    LCAS_MOD_SUCCESS : succes
    LCAS_MOD_FAIL    : failure
    LCAS_MOD_NOFILE  : db file not found
******************************************************************************/
#if 0
int plugin_initialize(char * plugin_db)
#endif
int plugin_initialize(int argc, char ** argv)
{
    int                           rc;
    char *                        dummy = NULL;

#if USE_GRIDMAP
    /* test with dummy values */
    rc = lcas_gridlist("\0", &dummy, NULL, MATCH_ONLY_DN, NULL, NULL);
    if ( rc == LCAS_MOD_NOFILE )
    {
        lcas_log(LOG_NOTICE,"\t%s-plugin_initialize() error: cannot find gridmap file\n",
                 modname);
        if (dummy != NULL) free(dummy);
        return LCAS_MOD_NOFILE;
    }
#else
    int                           i;

    lcas_log_debug(1,"%s-plugin_initialize(): passed arguments:\n", modname);
    for (i=0; i < argc; i++)
    {
        lcas_log_debug(1,"%s-plugin_initialize(): arg %d is %s\n",
             modname,i,argv[i]);
    }

    /* set db file (has to be freed) */
    if (argc > 1)
        userallow_db = lcas_findfile(argv[1]);

    /* Test if userallow_db can be opened */
    if (userallow_db == NULL)
    {
        lcas_log(0,"\t%s-plugin_initialize() error: allowed user file required !\n",
                   modname);
        return LCAS_MOD_NOFILE;
    }
    if (lcas_getfexist(1,userallow_db) == NULL)
    {
        lcas_log(0,
                 "\t%s-plugin_initialize() error: Cannot find allowed user file: %s\n",
                 modname,userallow_db
        );
        return LCAS_MOD_NOFILE;
    }
#endif
    if (dummy != NULL) free(dummy);
    return LCAS_MOD_SUCCESS;
}

/******************************************************************************
Function:   plugin_confirm_authorization
Description:
    Static user checking.
    In the future the information service will be contacted to check
    the permissions/roles of the user.
    For the moment only the gridmap file is checked.
Parameters:
    request: JDL
    user_cred : user globus credential handle
Returns:
    LCAS_MOD_SUCCESS: authorization succeeded
    LCAS_MOD_FAIL   : authorization failed
    LCAS_MOD_NOFILE : db file not found
******************************************************************************/
int
plugin_confirm_authorization(lcas_request_t request, lcas_cred_id_t lcas_cred)
{
    int                           rc;
    char *                        dummy = NULL;
    char *                        user_dn = NULL;

    /*
     * check credential and get the globus name
     */
    if ( (user_dn = lcas_get_dn(lcas_cred)) == NULL)
    {
        lcas_log(0, "lcas.mod-lcas_get_fabric_authorization() error: user DN empty\n");
        goto lcas_userallow_noauth;
    }

    /* Do the check */
#if USE_GRIDMAP
    lcas_log_debug(0,
    "\t%s-plugin_confirm_authorization(): checking allowed users in gridmapfile\n",
             modname);
    lcas_log_debug(0,
    "\t%s-plugin_confirm_authorization(): checking user %s\n",modname,user_dn);

    rc = lcas_gridlist(user_dn, &dummy, NULL, MATCH_ONLY_DN, NULL, NULL);
    lcas_log_debug(1,"got rc = %d from lcas_gridlist()\n",rc);
#else
    lcas_log_debug(0,
    "\t%s-plugin_confirm_authorization(): checking allowed users in %s\n",
             modname,userallow_db);

    rc = lcas_gridlist(user_dn, &dummy, userallow_db, MATCH_ONLY_DN, NULL, NULL);
    lcas_log_debug(1,"got rc = %d from lcas_gridlist()\n",rc);
#endif
    if ( rc == LCAS_MOD_NOENTRY )
    {
        /* No entry found for user_dn */
        lcas_log(0,"\t%s-plugin_confirm_authorization(): no entry found for %s\n",
                 modname,user_dn);
        goto lcas_userallow_noauth;
    }
    else if ( rc == LCAS_MOD_NOFILE )
    {
        /* File not found */
        lcas_log(0,
#if USE_GRIDMAP
            "\t%s-plugin_confirm_authorization() error: Cannot find gridmapfile\n",
            modname);
#else
            "\t%s-plugin_confirm_authorization() error: Cannot find allowed user file: %s\n",
            modname,userallow_db);
#endif
        goto lcas_userallow_nofile;
    }

 lcas_userallow_auth:
    /* authorization = entry found for user_dn */
    if (dummy != NULL) free(dummy);
    return LCAS_MOD_SUCCESS;

 lcas_userallow_noauth:
    /* no authorization = no entry found for user_dn */
    if (dummy != NULL) free(dummy);
    return LCAS_MOD_FAIL;

 lcas_userallow_nofile:
    /* file not found */
    if (dummy != NULL) free(dummy);
    return LCAS_MOD_NOFILE;
}

/******************************************************************************
Function:   plugin_terminate
Description:
    Terminate plugin
Parameters:

Returns:
    LCAS_MOD_SUCCESS : succes
    LCAS_MOD_FAIL    : failure
******************************************************************************/
int plugin_terminate()
{
    lcas_log_debug(1,"%s-plugin_terminate(): terminating\n",modname);
    if (userallow_db) { free(userallow_db); userallow_db=NULL; }

    return LCAS_MOD_SUCCESS;
}

---