Hello, Sergei. On Sunday March 1, 2009 19:44:44 Sergei Beilin wrote: > > Therefore, unfortunately the only way to get closer to a MAC policy is to > > cover all your controller actions with predicate checkers -- which of > > course has little/nothing to do with MAC; in fact, attaching predicate > > checkers to controllers is anti-MAC. :( > > Hm. If I subclass from a RestController, add some repoze.what magic > there to disable access to it (let's call it MACRestController), and > then subclass all my RESTful controller from that > MACREstController?...
It'd still be the same "everything is allowed unless explicitly told otherwise" approach, while what you were asking for is "everything is denied unless explicitly told otherwise". > > If, on the other hand, what you want is a DAC policy whereby a predicate > > checker covers the whole application, then that's perfectly possible. For > > example, you can force that to grant access to any controller, users must > > be logged in (but of course, some URls like "/login" must be > > whitelisted). Is this want you want? It's not a MAC policy strictly > > speaking because it's not a "access is denied unless told otherwise" > > approach, but it's very similar. > > I think it will work for me for some time until repoze.what v2 with > MAC will be released. OK, well, this is something which is going to be documented properly (http://trac.turbogears.org/ticket/2218), but to sum up, the approach I recommend is: 1.- Store the following repoze.what predicate checker somewhere in your app (e.g., yourcoolapp.lib.auth): <---- from repoze.what.predicates import Predicate class is_login(Predicate): """The current page doesn't handle authentication""" message = "%(path_info)s is does not handle logins or logouts" white_list = ['/login', '/login_handler', '/post_login_handler', '/logout', '/post_logout_handler'] def evaluate(self, environ, credentials): path_info = environ.get('PATH_INFO', '') if path_info not in self.white_list: self.unmet(path_info=path_info) ----> 2.- Use it along with the main predicate checker you need, wrapped around with the Any predicate checker: <---- from yourapplication.lib.auth import is_login class RootController(BaseController): allow_only = Any(not_anonymous(), is_login()) # ... ----> That's all the code you need. Please don't hesitate to ask if there's something that you don't understand ;-) Anyway, if you haven't already done so, reading this document will be helpful: http://turbogears.org/2.0/docs/main/Auth/index.html > And that will be the time to refactor the whole application ;) I'd think twice about it. Would it be worth all the effort? The only advantage I find in whitelist authorization over blacklist authorization, is that the former is less error-prone... So, I'd ask myself "is this advantage enough to consider refactoring the whole application?". Keep in mind that you'd have to re-implement every single access rule, which may be a huge change depending on your application. Cheers! -- Gustavo Narea <http://gustavonarea.net/>. Get rid of unethical constraints! Get freedomware: http://www.getgnulinux.org/ --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "TurboGears" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/turbogears?hl=en -~----------~----~----~----~------~----~------~--~---
