From 6261891fb827cd504aac5c1bd23ac39982513199 Mon Sep 17 00:00:00 2001 From: Derek Weitzel Date: Thu, 14 Jan 2021 17:49:10 -0600 Subject: [PATCH] Refactor how attributes are passed to chained auth plugins with SciTokens --- src/XrdSciTokens/XrdSciTokensAccess.cc | 40 +++++++++++++++++--------- 1 file changed, 27 insertions(+), 13 deletions(-) diff --git a/src/XrdSciTokens/XrdSciTokensAccess.cc b/src/XrdSciTokens/XrdSciTokensAccess.cc index 1ff3d560bd9..4921ea2dff4 100644 --- a/src/XrdSciTokens/XrdSciTokensAccess.cc +++ b/src/XrdSciTokens/XrdSciTokensAccess.cc @@ -2,6 +2,7 @@ #include "XrdAcc/XrdAccAuthorize.hh" #include "XrdOuc/XrdOucEnv.hh" #include "XrdSec/XrdSecEntity.hh" +#include "XrdSec/XrdSecEntityAttr.hh" #include "XrdSys/XrdSysLogger.hh" #include "XrdVersion.hh" @@ -354,13 +355,13 @@ class XrdAccSciTokens : public XrdAccAuthorize, public XrdSciTokensHelper // We always populate the issuer and the groups, if present. // Access may be authorized; populate XrdSecEntity - auto mutable_entity = const_cast(Entity); - free(mutable_entity->vorg); mutable_entity->vorg = nullptr; - free(mutable_entity->grps); mutable_entity->grps = nullptr; - free(mutable_entity->role); mutable_entity->role = nullptr; + XrdSecEntity new_secentity; + new_secentity.vorg = nullptr; + new_secentity.grps = nullptr; + new_secentity.role = nullptr; const auto &issuer = access_rules->get_issuer(); if (!issuer.empty()) { - mutable_entity->vorg = strdup(issuer.c_str()); + new_secentity.vorg = strdup(issuer.c_str()); } if (access_rules->groups().size()) { std::stringstream ss; @@ -368,10 +369,10 @@ class XrdAccSciTokens : public XrdAccAuthorize, public XrdSciTokensHelper ss << grp << " "; } const auto &groups_str = ss.str(); - mutable_entity->grps = static_cast(malloc(groups_str.size())); - if (mutable_entity->grps) { - memcpy(mutable_entity->grps, groups_str.c_str(), groups_str.size()); - mutable_entity->grps[groups_str.size()] = '\0'; + new_secentity.grps = static_cast(malloc(groups_str.size())); + if (new_secentity.grps) { + memcpy(new_secentity.grps, groups_str.c_str(), groups_str.size()); + new_secentity.grps[groups_str.size()] = '\0'; } } @@ -384,7 +385,13 @@ class XrdAccSciTokens : public XrdAccAuthorize, public XrdSciTokensHelper scope_success = access_rules->apply(oper, path); if (!scope_success && !mapping_success) { - return OnMissing(Entity, path, oper, env); + auto returned_accs = OnMissing(&new_secentity, path, oper, env); + // Clean up the new_secentity + if (new_secentity.vorg != nullptr) free(new_secentity.vorg); + if (new_secentity.grps != nullptr) free(new_secentity.grps); + if (new_secentity.role != nullptr) free(new_secentity.role); + + return returned_accs; } // Default user only applies to scope-based mappings. @@ -393,12 +400,19 @@ class XrdAccSciTokens : public XrdAccAuthorize, public XrdSciTokensHelper } if (mapping_success) { - free(mutable_entity->name); - mutable_entity->name = strdup(username.c_str()); + // Set scitokens.name in the extra attribute + Entity->eaAPI->Add("scitokens.name", username, true); } // When the scope authorized this access, allow immediately. Otherwise, chain - return scope_success ? AddPriv(oper, XrdAccPriv_None) : OnMissing(Entity, path, oper, env); + XrdAccPrivs returned_op = scope_success ? AddPriv(oper, XrdAccPriv_None) : OnMissing(&new_secentity, path, oper, env); + + // Cleanup the new_secentry + if (new_secentity.vorg != nullptr) free(new_secentity.vorg); + if (new_secentity.grps != nullptr) free(new_secentity.grps); + if (new_secentity.role != nullptr) free(new_secentity.role); + + return returned_op; } virtual Issuers IssuerList() override