Module: Puppet::Network::Authorization

Included in:
XMLRPCProcessor
Defined in:
lib/vendor/puppet/network/authorization.rb

Instance Method Summary collapse

Instance Method Details

#authconfig ⇒ Object

Create our config object if necessary. This works even if there’s no configuration file.



12
13
14
15
16
 
# File 'lib/vendor/puppet/network/authorization.rb', line 12

def authconfig
  @authconfig ||= Puppet::Network::AuthConfig.main

  @authconfig
end

#authorized?(request) ⇒ Boolean

Verify that our client has access. We allow untrusted access to puppetca methods but no others.



20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
 
# File 'lib/vendor/puppet/network/authorization.rb', line 20

def authorized?(request)
  msg = "#{request.authenticated? ? "authenticated" : "unauthenticated"} client #{request} access to #{request.call}"

  if request.authenticated?
    if authconfig.exists?
      if authconfig.allowed?(request)
        Puppet.debug "Allowing #{msg}"
        return true
      else
        Puppet.notice "Denying #{msg}"
        return false
      end
    else
      if Puppet.run_mode.master?
        Puppet.debug "Allowing #{msg}"
        return true
      else
        Puppet.notice "Denying #{msg}"
        return false
      end
    end
  else
    if request.handler == "puppetca"
      Puppet.notice "Allowing #{msg}"
    else
      Puppet.notice "Denying #{msg}"
      return false
    end
  end
end

#available?(request) ⇒ Boolean

Is this functionality available?



52
53
54
55
56
57
58
59
 
# File 'lib/vendor/puppet/network/authorization.rb', line 52

def available?(request)
  if handler_loaded?(request.handler)
    return true
  else
    Puppet.warning "Client #{request} requested unavailable functionality #{request.handler}"
    return false
  end
end

#verify(request) ⇒ Object

Make sure that this method is available and authorized.



62
63
64
65
66
67
68
69
70
71
72
73
 
# File 'lib/vendor/puppet/network/authorization.rb', line 62

def verify(request)
  unless available?(request)
    raise InvalidClientRequest.new(
      "Functionality #{request.handler} not available"
    )
  end
  unless authorized?(request)
    raise InvalidClientRequest.new(
      "Host #{request} not authorized to call #{request.call}"
    )
  end
end