092aad40bd
Things changed, and the configuration wasn't read anymore. This patch fixes that. It also remove duplicated code in acl.py, so the problem is fixed only in one place. Finally, it uses prepare_service() to find the right configuration file for ceilometer. This fixes bug #1098204 Change-Id: I0d6c30ad443a4d0db201e60d12b275625a4bee6e Signed-off-by: Julien Danjou <julien@danjou.info>
56 lines
1.7 KiB
Python
56 lines
1.7 KiB
Python
# -*- encoding: utf-8 -*-
|
|
#
|
|
# Copyright © 2012 New Dream Network, LLC (DreamHost)
|
|
#
|
|
# Author: Doug Hellmann <doug.hellmann@dreamhost.com>
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
# not use this file except in compliance with the License. You may obtain
|
|
# a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
# License for the specific language governing permissions and limitations
|
|
# under the License.
|
|
"""Set up the ACL to acces the API server."""
|
|
|
|
from ceilometer import policy
|
|
|
|
from pecan import hooks
|
|
|
|
from webob import exc
|
|
|
|
import keystoneclient.middleware.auth_token as auth_token
|
|
|
|
OPT_GROUP_NAME = 'keystone_authtoken'
|
|
|
|
|
|
def register_opts(conf):
|
|
"""Register keystoneclient middleware options
|
|
"""
|
|
conf.register_opts(auth_token.opts,
|
|
group=OPT_GROUP_NAME)
|
|
auth_token.CONF = conf
|
|
|
|
|
|
def install(app, conf):
|
|
"""Install ACL check on application."""
|
|
register_opts(conf)
|
|
return auth_token.AuthProtocol(app,
|
|
conf=dict(conf.get(OPT_GROUP_NAME)))
|
|
|
|
|
|
class AdminAuthHook(hooks.PecanHook):
|
|
"""Verify that the user has admin rights
|
|
"""
|
|
|
|
def before(self, state):
|
|
headers = state.request.headers
|
|
if not policy.check_is_admin(headers.get('X-Roles', "").split(","),
|
|
headers.get('X-Tenant-Id'),
|
|
headers.get('X-Tenant-Name')):
|
|
raise exc.HTTPUnauthorized()
|