Module: Puppet::Network::Authorization

Included in:
XMLRPCProcessor
Defined in:
lib/vendor/puppet/network/authorization.rb

Instance Method Summary collapse

Instance Method Details

#authconfig ⇒ Object

Create our config object if necessary. This works even if there’s no configuration file.



12
13
14
15
16
 
# File 'lib/vendor/puppet/network/authorization.rb', line 12

def authconfig
  @authconfig ||= Puppet::Network::AuthConfig.main

  @authconfig
end

#authorized?(request) ⇒ Boolean

Verify that our client has access. We allow untrusted access to puppetca methods but no others.

Returns:

  • (Boolean) 


20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
 
# File 'lib/vendor/puppet/network/authorization.rb', line 20

def authorized?(request)
  msg = "#{request.authenticated? ? "authenticated" : "unauthenticated"} client #{request} access to #{request.call}"

  if request.authenticated?
    if authconfig.exists?
      if authconfig.allowed?(request)
        Puppet.debug "Allowing #{msg}"
        return true
      else
        Puppet.notice "Denying #{msg}"
        return false
      end
    else
      if Puppet.run_mode.master?
        Puppet.debug "Allowing #{msg}"
        return true
      else
        Puppet.notice "Denying #{msg}"
        return false
      end
    end
  else
    if request.handler == "puppetca"
      Puppet.notice "Allowing #{msg}"
    else
      Puppet.notice "Denying #{msg}"
      return false
    end
  end
end

#available?(request) ⇒ Boolean

Is this functionality available?

Returns:

  • (Boolean) 


52
53
54
55
56
57
58
59
 
# File 'lib/vendor/puppet/network/authorization.rb', line 52

def available?(request)
  if handler_loaded?(request.handler)
    return true
  else
    Puppet.warning "Client #{request} requested unavailable functionality #{request.handler}"
    return false
  end
end

#verify(request) ⇒ Object

Make sure that this method is available and authorized.



62
63
64
65
66
67
68
69
70
71
72
73
 
# File 'lib/vendor/puppet/network/authorization.rb', line 62

def verify(request)
  unless available?(request)
    raise InvalidClientRequest.new(
      "Functionality #{request.handler} not available"
    )
  end
  unless authorized?(request)
    raise InvalidClientRequest.new(
      "Host #{request} not authorized to call #{request.call}"
    )
  end
end