security Package¶

`security` Package¶

Security

`authentication` Module¶

class opennode.oms.security.authentication.AuthenticationUtility[source]¶

Bases: grokcore.component.components.GlobalUtility

getPrincipal(id)[source]¶

registerPrincipal(principal)[source]¶

class opennode.oms.security.authentication.PamAuthChecker[source]¶

Bases: object

Check user credentials using PAM infrastructure

credentialInterfaces = <InterfaceClass twisted.cred.credentials.IUsernamePassword>¶

requestAvatarId(credentials)[source]¶

opennode.oms.security.authentication.checkers()[source]¶

opennode.oms.security.authentication.create_special_principals()[source]¶

opennode.oms.security.authentication.get_linux_groups_for_user(user)[source]¶

opennode.oms.security.authentication.reload_groups(stream)[source]¶

opennode.oms.security.authentication.reload_roles(stream)[source]¶

opennode.oms.security.authentication.reload_users(stream)[source]¶

opennode.oms.security.authentication.setup_conf_reload_watch(path, handler)[source]¶: Registers a inotify watch which will invoke handler for passing the open file

opennode.oms.security.authentication.setup_groups(event)[source]¶

opennode.oms.security.authentication.setup_permissions(event)[source]¶

opennode.oms.security.authentication.setup_roles(event)[source]¶

opennode.oms.security.authentication.ssha_hash(user, password, encoded_password)[source]¶

`checker` Module¶

class opennode.oms.security.checker.AuditingPermissionDictionary[source]¶

Bases: dict

get(key, default=None)[source]¶

marker = <object object at 0x38cc670>¶

seen = {}¶

class opennode.oms.security.checker.Checker(get_permissions, set_permissions=None, interaction=None)[source]¶

Bases: object

check(object, name)[source]¶: See IChecker

check_getattr(object, name)[source]¶: See IChecker

check_setattr(object, name)[source]¶: See IChecker

permission_id(name)[source]¶: See INameBasedChecker

proxy(value)[source]¶: See IChecker

setattr_permission_id(name)[source]¶: See INameBasedChecker

opennode.oms.security.checker.get_interaction(obj)[source]¶: Extract interaction from a proxied object

opennode.oms.security.checker.proxy_factory(value, interaction)[source]¶

class opennode.oms.security.checker.strong_defaultdict[source]¶

Bases: collections.defaultdict

Python’s defaultdict type doesn’t invoke default factory when called with get, we need this subclass to implement a permissive checker.

get(name)[source]¶

`directives` Module¶

class opennode.oms.security.directives.permissions(*args, **kw)[source]¶

Bases: martian.directive.Directive

Use this directive in a class in order to set it’s attribute’s permissions.

default = None¶

scope = <martian.directive.ClassScope object at 0x2821cd0>¶

store = <martian.directive.StoreOnce object at 0x2821910>¶

`grokkers` Module¶

class opennode.oms.security.grokkers.SecurityGrokker[source]¶

Bases: martian.components.ClassGrokker

execute(factory, config, permissions, **kw)[source]¶

`interaction` Module¶

class opennode.oms.security.interaction.OmsSecurityPolicy(*args, **kw)[source]¶

Bases: zope.securitypolicy.zopepolicy.ZopeSecurityPolicy

A Security Policy represents an interaction with a principal and performs the actual checks.

The default zope security system depends on keeping the current interaction in a thread local variable. OMS is based on the twisted async model and thus we avoid setting the current interaction within the current thread, as it could be used by different callbacks in the reactor.

We rely on a custom checker (see opennode.oms.security.checker) for embedding the interaction inside the security proxy itself; however in some cases we need to use security proxies which are created by other libraries (like secured adapters created for IPrincipalRoleManager) and in that cases we need to temporarily setup an interaction for the current thread, but we have to avoid that it leaks out to other coroutines.

For that end, we extend ZopeSecurityPolicy in such a way that it can be used as:

>>> with interaction:
...    primrole = IPrincipalRoleManager(obj)
...    primrole.getRolesForPrincipal(id)
...    # ...

The with context guard will ensure that the function containing this construct is not a generator, because using it in a defer.inlineCallbacks method will result in leaking the interaction to other goroutines.

class opennode.oms.security.interaction.SessionStub(principal=None)[source]¶: Bases: object

opennode.oms.security.interaction.new_interaction(principal)[source]¶

`passwd` Module¶

opennode.oms.security.passwd.ask_password()[source]¶

opennode.oms.security.passwd.hash_pw(password)[source]¶

opennode.oms.security.passwd.run()[source]¶

`permissions` Module¶

class opennode.oms.security.permissions.Add(id, title='', description='')[source]¶: Bases: grokcore.security.components.Permission

class opennode.oms.security.permissions.Create(id, title='', description='')[source]¶: Bases: grokcore.security.components.Permission

class opennode.oms.security.permissions.Delete(id, title='', description='')[source]¶: Bases: grokcore.security.components.Permission

class opennode.oms.security.permissions.Modify(id, title='', description='')[source]¶: Bases: grokcore.security.components.Permission

class opennode.oms.security.permissions.Nothing(id, title='', description='')[source]¶: Bases: grokcore.security.components.Permission

class opennode.oms.security.permissions.Read(id, title='', description='')[source]¶: Bases: grokcore.security.components.Permission

class opennode.oms.security.permissions.Remove(id, title='', description='')[source]¶: Bases: grokcore.security.components.Permission

class opennode.oms.security.permissions.Rest(id, title='', description='')[source]¶: Bases: grokcore.security.components.Permission

class opennode.oms.security.permissions.Role(name, nick)[source]¶

Bases: zope.securitypolicy.role.Role

Oms roles act as permissions

nick_to_role = {}¶

role_to_nick = {}¶

class opennode.oms.security.permissions.Traverse(id, title='', description='')[source]¶: Bases: grokcore.security.components.Permission

class opennode.oms.security.permissions.View(id, title='', description='')[source]¶: Bases: grokcore.security.components.Permission

`principals` Module¶

class opennode.oms.security.principals.Group(id)[source]¶: Bases: opennode.oms.security.principals.User

class opennode.oms.security.principals.User(id)[source]¶: Bases: object

opennode.oms.security.principals.effective_principals(principal_or_interaction, acc=None)[source]¶: Returns all the principals including recursive groups

security Package¶