00001 #ifndef __SecsssID__ 00002 #define __SecsssID__ 00003 /******************************************************************************/ 00004 /* */ 00005 /* X r d S e c s s s I D . h h */ 00006 /* */ 00007 /* (c) 2008 by the Board of Trustees of the Leland Stanford, Jr., University */ 00008 /* All Rights Reserved */ 00009 /* Produced by Andrew Hanushevsky for Stanford University under contract */ 00010 /* DE-AC02-76-SFO0515 with the Department of Energy */ 00011 /* */ 00012 /* This file is part of the XRootD software suite. */ 00013 /* */ 00014 /* XRootD is free software: you can redistribute it and/or modify it under */ 00015 /* the terms of the GNU Lesser General Public License as published by the */ 00016 /* Free Software Foundation, either version 3 of the License, or (at your */ 00017 /* option) any later version. */ 00018 /* */ 00019 /* XRootD is distributed in the hope that it will be useful, but WITHOUT */ 00020 /* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or */ 00021 /* FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public */ 00022 /* License for more details. */ 00023 /* */ 00024 /* You should have received a copy of the GNU Lesser General Public License */ 00025 /* along with XRootD in a file called COPYING.LESSER (LGPL license) and file */ 00026 /* COPYING (GPL license). If not, see <http://www.gnu.org/licenses/>. */ 00027 /* */ 00028 /* The copyright holder's institutional names and contributor's names may not */ 00029 /* be used to endorse or promote products derived from this software without */ 00030 /* specific prior written permission of the institution or contributor. */ 00031 /******************************************************************************/ 00032 00033 #include <string.h> 00034 #include <time.h> 00035 00036 #include "XrdOuc/XrdOucHash.hh" 00037 #include "XrdSec/XrdSecEntity.hh" 00038 #include "XrdSys/XrdSysPthread.hh" 00039 00040 // The XrdSecsssID class allows you to establish a registery to map loginid's 00041 // to arbitrary entities. By default, the sss security protocol uses the 00042 // username as the authenticated username and, if possible, the corresponding 00043 // primary group membership of username (i.e., static mapping). The server is 00044 // will ignore the username and/or the groupname unless the key is designated 00045 // as anyuser, anygroup, respectively. By creating an instance of this class 00046 // you can over-ride the default and map the loginid (i.e., the id supplied 00047 // at login time which is normally the first 8-characters of the username or 00048 // the id specified in the url; i.e., id@host) to arbitrary entities using 00049 // the Register() method. You must create one, and only one, such instance 00050 // prior to making any contact with a sss security enabled server. 00051 00052 // In order to include XrdSecsssID methods, you should either link with 00053 // libXrdSecsss.so (preferable) or include XrdSecsssID.o and link with 00054 // libXrdOuc.a and libXrdSys.a. 00055 00056 class XrdSecsssID 00057 { 00058 public: 00059 00060 // Register() creates a mapping from a loginid to an entity description. Only 00061 // name, vo, role, group, and endorements pointers in XrdSecEntity 00062 // are supported. To de-register a loginid, make the Ident arg zero. 00063 // To replace an existing entry, specify 1 for doReplace argument. 00064 // TRUE is returned if successful; FALSE otherwise (including the 00065 // case where idDynamic was not specified in the constructor or 00066 // doReplace is zero and the loginid has already been registered). 00067 // 00068 int Register(const char *loginid, XrdSecEntity *Ident, int doReplace=0); 00069 00070 // Find() is an internal look-up method that returns the identification 00071 // string in the provided buffer corresponding to the loginid. 00072 // If loginid is registered and the data will fit into the buffer the 00073 // length moved into the buffer is returned. Otherwise, the default ID 00074 // is moved into the buffer and the length copied is returned. If that 00075 // is not possible, 0 is returned. 00076 // 00077 int Find(const char *loginid, char *Buff, int Blen); 00078 00079 // A single instance of this class may be instantiated. The first parameter 00080 // indicates how authentication is to be handled. The second parameter provides 00081 // either a fixed or default authenticated identity under control of the aType 00082 // parameter, as follows: 00083 // 00084 enum authType {idDynamic = 0, // Mutual: Map loginid to registered identity 00085 // Ident is default; if 0 nobody/nogroup 00086 idStatic = 1, // 1Sided: fixed identity sent to the server 00087 // Ident as specified; if 0 process uid/gid 00088 // Default if XrdSecsssID not instantiated! 00089 idStaticM = 2 // Mutual: fixed identity sent to the server 00090 // Ident as specified; if 0 process uid/gid 00091 }; 00092 00093 // getObj() returns the address of a previous created instance of this object or 00094 // zero if no instance exists. It also returns authType and default ID 00095 // to be used regardless of the return value. 00096 // 00097 static 00098 XrdSecsssID *getObj(authType &aType, char **dID, int &dIDsz); 00099 00100 XrdSecsssID(authType aType=idStatic, XrdSecEntity *Ident=0); 00101 00102 ~XrdSecsssID() {if (defaultID) free(defaultID);} 00103 00104 private: 00105 00106 struct sssID {int iLen; char iData[1];}; // Sized appropriately 00107 static sssID *genID(int Secure); 00108 static sssID *genID(XrdSecEntity *eP); 00109 00110 static XrdSysMutex InitMutex; 00111 sssID *defaultID; 00112 XrdSysMutex myMutex; 00113 XrdOucHash<sssID> Registry; 00114 authType myAuth; 00115 }; 00116 #endif