| Index: trunk/extensions/OpenStackManager/OpenStackNovaUser.php |
| — | — | @@ -140,9 +140,60 @@ |
| 141 | 141 | } |
| 142 | 142 | } |
| 143 | 143 | |
| 144 | | - function inRole( $role, $project = '' ) { |
| 145 | | - # Currently unsupported |
| 146 | | - return true; |
| | 144 | + function inRole( $role, $projectname = '' ) { |
| | 145 | + global $wgAuth; |
| | 146 | + global $wgOpenStackManagerLDAPGlobalRoles; |
| | 147 | + |
| | 148 | + if ( ! array_key_exists( $wgOpenStackManagerLDAPGlobalRoles, $role ) ) { |
| | 149 | + return false; |
| | 150 | + } |
| | 151 | + |
| | 152 | + if ( $wgOpenStackManagerLDAPGlobalRoles["$role"] ) { |
| | 153 | + # Check global role |
| | 154 | + $roledn = $wgOpenStackManagerLDAPGlobalRoles["$role"]; |
| | 155 | + $filter = "(member=$this->userDN)"; |
| | 156 | + wfSuppressWarnings(); |
| | 157 | + $result = ldap_search( $wgAuth->ldapconn, $roledn, $filter ); |
| | 158 | + wfRestoreWarnings(); |
| | 159 | + if ( $result ) { |
| | 160 | + wfSuppressWarnings(); |
| | 161 | + $entries = ldap_get_entries( $wgAuth->ldapconn, $result ); |
| | 162 | + wfRestoreWarnings(); |
| | 163 | + if ( (int)$entries['count'] > 0 ) { |
| | 164 | + return true; |
| | 165 | + } |
| | 166 | + } |
| | 167 | + } |
| | 168 | + |
| | 169 | + if ( $projectname ) { |
| | 170 | + # Check project specific role |
| | 171 | + $project = OpenStackNovaProject::getProjectByName( $projectname ); |
| | 172 | + if ( ! $project ) { |
| | 173 | + return false; |
| | 174 | + } |
| | 175 | + $filter = "(&(cn=$role)(member=$this->userDN))"; |
| | 176 | + wfSuppressWarnings(); |
| | 177 | + $result = ldap_search( $wgAuth->ldapconn, $project->projectDN, $filter ); |
| | 178 | + wfRestoreWarnings(); |
| | 179 | + if ( $result ) { |
| | 180 | + wfSuppressWarnings(); |
| | 181 | + $entries = ldap_get_entries( $wgAuth->ldapconn, $result ); |
| | 182 | + wfRestoreWarnings(); |
| | 183 | + if ( $entries ) { |
| | 184 | + if ( $entries['count'] == "0" ) { |
| | 185 | + $wgAuth->printDebug( "Couldn't find the user in role: $role", NONSENSITIVE ); |
| | 186 | + return false; |
| | 187 | + } else { |
| | 188 | + return true; |
| | 189 | + } |
| | 190 | + } else { |
| | 191 | + return false; |
| | 192 | + } |
| | 193 | + } else { |
| | 194 | + return false; |
| | 195 | + } |
| | 196 | + } |
| | 197 | + return false; |
| 147 | 198 | } |
| 148 | 199 | |
| 149 | 200 | function connect() { |
| Index: trunk/extensions/OpenStackManager/special/SpecialNovaInstance.php |
| — | — | @@ -66,6 +66,11 @@ |
| 67 | 67 | $this->setHeaders(); |
| 68 | 68 | $wgOut->setPagetitle( wfMsg( 'openstackmanager-createinstance' ) ); |
| 69 | 69 | |
| | 70 | + $project = $wgRequest->getText( 'project' ); |
| | 71 | + if ( ! $this->userLDAP->inRole( 'sysadmin', $project ) ) { |
| | 72 | + $this->notInRole( 'sysadmin' ); |
| | 73 | + return false; |
| | 74 | + } |
| 70 | 75 | $instanceInfo = Array(); |
| 71 | 76 | $instanceInfo['instancename'] = array( |
| 72 | 77 | 'type' => 'text', |
| — | — | @@ -145,7 +150,7 @@ |
| 146 | 151 | |
| 147 | 152 | $instanceInfo['project'] = array( |
| 148 | 153 | 'type' => 'hidden', |
| 149 | | - 'default' => $wgRequest->getText( 'project' ), |
| | 154 | + 'default' => $project, |
| 150 | 155 | ); |
| 151 | 156 | |
| 152 | 157 | if ( $wgOpenStackManagerPuppetOptions['enabled'] ) { |
| — | — | @@ -193,8 +198,12 @@ |
| 194 | 199 | $this->setHeaders(); |
| 195 | 200 | $wgOut->setPagetitle( wfMsg( 'openstackmanager-configureinstance' ) ); |
| 196 | 201 | |
| | 202 | + $project = $wgRequest->getText( 'project' ); |
| | 203 | + if ( ! $this->userLDAP->inRole( 'sysadmin', $project ) ) { |
| | 204 | + $this->notInRole( 'sysadmin' ); |
| | 205 | + return false; |
| | 206 | + } |
| 197 | 207 | $instanceid = $wgRequest->getText( 'instanceid' ); |
| 198 | | - |
| 199 | 208 | $instanceInfo = Array(); |
| 200 | 209 | $instanceInfo['instanceid'] = array( |
| 201 | 210 | 'type' => 'hidden', |
| — | — | @@ -202,7 +211,7 @@ |
| 203 | 212 | ); |
| 204 | 213 | $instanceInfo['project'] = array( |
| 205 | 214 | 'type' => 'hidden', |
| 206 | | - 'default' => $wgRequest->getText( 'project' ), |
| | 215 | + 'default' => $project, |
| 207 | 216 | ); |
| 208 | 217 | |
| 209 | 218 | if ( $wgOpenStackManagerPuppetOptions['enabled'] ) { |
| — | — | @@ -267,8 +276,12 @@ |
| 268 | 277 | $this->setHeaders(); |
| 269 | 278 | $wgOut->setPagetitle( wfMsg( 'openstackmanager-deletedomain' ) ); |
| 270 | 279 | |
| | 280 | + $project = $wgRequest->getText( 'project' ); |
| | 281 | + if ( ! $this->userLDAP->inRole( 'sysadmin', $project ) ) { |
| | 282 | + $this->notInRole( 'sysadmin' ); |
| | 283 | + return false; |
| | 284 | + } |
| 271 | 285 | $instanceid = $wgRequest->getText( 'instanceid' ); |
| 272 | | - $project = $wgRequest->getText( 'project' ); |
| 273 | 286 | if ( ! $wgRequest->wasPosted() ) { |
| 274 | 287 | $out = Html::element( 'p', array(), wfMsgExt( 'openstackmanager-deleteinstancequestion', array(), $instanceid ) ); |
| 275 | 288 | $wgOut->addHTML( $out ); |
| — | — | @@ -296,10 +309,6 @@ |
| 297 | 310 | return true; |
| 298 | 311 | } |
| 299 | 312 | |
| 300 | | - function modifyInstance() { |
| 301 | | - return true; |
| 302 | | - } |
| 303 | | - |
| 304 | 313 | function listInstances() { |
| 305 | 314 | global $wgOut, $wgUser; |
| 306 | 315 | |
| Index: trunk/extensions/OpenStackManager/special/SpecialNovaAddress.php |
| — | — | @@ -46,6 +46,10 @@ |
| 47 | 47 | $wgOut->setPagetitle( wfMsg( 'openstackmanager-allocateaddress' ) ); |
| 48 | 48 | |
| 49 | 49 | $project = $wgRequest->getText( 'project' ); |
| | 50 | + if ( ! $this->userLDAP->inRole( 'netadmin', $project ) ) { |
| | 51 | + $this->notInRole( 'netadmin' ); |
| | 52 | + return false; |
| | 53 | + } |
| 50 | 54 | $userCredentials = $this->userLDAP->getCredentials( $project ); |
| 51 | 55 | $this->userNova = new OpenStackNovaController( $userCredentials ); |
| 52 | 56 | if ( ! $wgRequest->wasPosted() ) { |
| — | — | @@ -78,6 +82,10 @@ |
| 79 | 83 | $wgOut->setPagetitle( wfMsg( 'openstackmanager-releaseaddress' ) ); |
| 80 | 84 | |
| 81 | 85 | $project = $wgRequest->getText( 'project' ); |
| | 86 | + if ( ! $this->userLDAP->inRole( 'netadmin', $project ) ) { |
| | 87 | + $this->notInRole( 'netadmin' ); |
| | 88 | + return false; |
| | 89 | + } |
| 82 | 90 | $userCredentials = $this->userLDAP->getCredentials( $project ); |
| 83 | 91 | $this->userNova = new OpenStackNovaController( $userCredentials ); |
| 84 | 92 | $ip = $wgRequest->getText( 'ip' ); |
| — | — | @@ -116,6 +124,10 @@ |
| 117 | 125 | |
| 118 | 126 | $ip = $wgRequest->getText( 'ip' ); |
| 119 | 127 | $project = $wgRequest->getText( 'project' ); |
| | 128 | + if ( ! $this->userLDAP->inRole( 'netadmin', $project ) ) { |
| | 129 | + $this->notInRole( 'netadmin' ); |
| | 130 | + return false; |
| | 131 | + } |
| 120 | 132 | $userCredentials = $this->userLDAP->getCredentials( $project ); |
| 121 | 133 | $this->userNova = new OpenStackNovaController( $userCredentials ); |
| 122 | 134 | $instances = $this->userNova->getInstances(); |
| — | — | @@ -160,6 +172,10 @@ |
| 161 | 173 | $wgOut->setPagetitle( wfMsg( 'openstackmanager-disassociateaddress' ) ); |
| 162 | 174 | |
| 163 | 175 | $project = $wgRequest->getText( 'project' ); |
| | 176 | + if ( ! $this->userLDAP->inRole( 'netadmin', $project ) ) { |
| | 177 | + $this->notInRole( 'netadmin' ); |
| | 178 | + return false; |
| | 179 | + } |
| 164 | 180 | $userCredentials = $this->userLDAP->getCredentials( $project ); |
| 165 | 181 | $this->userNova = new OpenStackNovaController( $userCredentials ); |
| 166 | 182 | $ip = $wgRequest->getText( 'ip' ); |
| Index: trunk/extensions/OpenStackManager/special/SpecialNovaProject.php |
| — | — | @@ -4,7 +4,7 @@ |
| 5 | 5 | var $userNova, $adminNova; |
| 6 | 6 | |
| 7 | 7 | function __construct() { |
| 8 | | - parent::__construct( 'NovaProject' ); |
| | 8 | + parent::__construct( 'NovaProject', 'manageproject' ); |
| 9 | 9 | |
| 10 | 10 | global $wgOpenStackManagerNovaAdminKeys; |
| 11 | 11 | |
| — | — | @@ -13,26 +13,14 @@ |
| 14 | 14 | $this->adminNova = new OpenStackNovaController( $adminCredentials ); |
| 15 | 15 | } |
| 16 | 16 | |
| 17 | | - public function isRestricted() { |
| 18 | | - return true; |
| 19 | | - } |
| 20 | | - |
| 21 | | -# public function userCanExecute( $user ) { |
| 22 | | -# global $wgRequest; |
| 23 | | -# |
| 24 | | -# #$project = $wgRequest->getVal('project'); |
| 25 | | -# #if ( $project && ! $this->userLDAP->inProject( $project ) ) { |
| 26 | | -# # return false; |
| 27 | | -# #} |
| 28 | | -# return true; |
| 29 | | -# } |
| 30 | | - |
| 31 | 17 | function execute( $par ) { |
| 32 | 18 | global $wgRequest, $wgUser; |
| 33 | 19 | |
| 34 | | - # if ( ! $wgUser->isAllowed( 'manageproject' ) ) { |
| 35 | | - # return false; |
| 36 | | - # } |
| | 20 | + if ( !$this->userCanExecute( $wgUser ) ) { |
| | 21 | + $this->displayRestrictionError(); |
| | 22 | + return false; |
| | 23 | + } |
| | 24 | + |
| 37 | 25 | if ( ! $wgUser->isLoggedIn() ) { |
| 38 | 26 | $this->notLoggedIn(); |
| 39 | 27 | return false; |
| Index: trunk/extensions/OpenStackManager/special/SpecialNovaDomain.php |
| — | — | @@ -12,10 +12,6 @@ |
| 13 | 13 | $this->adminNova = new OpenStackNovaController( $wgOpenStackManagerNovaAdminKeys ); |
| 14 | 14 | } |
| 15 | 15 | |
| 16 | | - public function isRestricted() { |
| 17 | | - return true; |
| 18 | | - } |
| 19 | | - |
| 20 | 16 | function execute( $par ) { |
| 21 | 17 | global $wgRequest, $wgUser; |
| 22 | 18 | |
| — | — | @@ -26,6 +22,12 @@ |
| 27 | 23 | $this->notLoggedIn(); |
| 28 | 24 | return false; |
| 29 | 25 | } |
| | 26 | + $project = $wgRequest->getText( 'project' ); |
| | 27 | + # Must be in the global role |
| | 28 | + if ( ! $this->userLDAP->inRole( 'netadmin' ) ) { |
| | 29 | + $this->notInRole( 'netadmin' ); |
| | 30 | + return false; |
| | 31 | + } |
| 30 | 32 | |
| 31 | 33 | $action = $wgRequest->getVal( 'action' ); |
| 32 | 34 | if ( $action == "create" ) { |
| Index: trunk/extensions/OpenStackManager/special/SpecialNovaKey.php |
| — | — | @@ -7,10 +7,6 @@ |
| 8 | 8 | parent::__construct( 'NovaKey' ); |
| 9 | 9 | } |
| 10 | 10 | |
| 11 | | - public function isRestricted() { |
| 12 | | - return true; |
| 13 | | - } |
| 14 | | - |
| 15 | 11 | function execute( $par ) { |
| 16 | 12 | global $wgRequest, $wgUser; |
| 17 | 13 | |
| Index: trunk/extensions/OpenStackManager/special/SpecialNova.php |
| — | — | @@ -24,4 +24,17 @@ |
| 25 | 25 | $wgOut->setPagetitle( wfMsg( 'openstackmanager-noaccount' ) ); |
| 26 | 26 | $wgOut->addHTML( wfMsg( 'openstackmanager-noaccount2' ) ); |
| 27 | 27 | } |
| | 28 | + |
| | 29 | + function notInRole( $role ) { |
| | 30 | + global $wgOut; |
| | 31 | + |
| | 32 | + $this->setHeaders(); |
| | 33 | + if ( $role == 'sysadmin' ) { |
| | 34 | + $wgOut->setPagetitle( wfMsg( 'openstackmanager-needsysadminrole' ) ); |
| | 35 | + $wgOut->addHTML( wfMsg( 'openstackmanager-needsysadminrole2' ) ); |
| | 36 | + } else if ( $role == 'netadmin' ) { |
| | 37 | + $wgOut->setPagetitle( wfMsg( 'openstackmanager-neednetadminrole' ) ); |
| | 38 | + $wgOut->addHTML( wfMsg( 'openstackmanager-neednetadminrole2' ) ); |
| | 39 | + } |
| | 40 | + } |
| 28 | 41 | } |
| Index: trunk/extensions/OpenStackManager/OpenStackManager.i18n.php |
| — | — | @@ -22,6 +22,13 @@ |
| 23 | 23 | 'openstackmanager-instance' => 'Manage Instance', |
| 24 | 24 | 'openstackmanager-title' => 'OpenStackManager', |
| 25 | 25 | |
| | 26 | + 'specialpages-group-nova' => 'OpenStack Nova', |
| | 27 | + 'novaaddress' => 'Manage public IP addresses', |
| | 28 | + 'novadomain' => 'Manage DNS domains', |
| | 29 | + 'novainstance' => 'Manage Instances', |
| | 30 | + 'novakey' => 'Manage your public SSH keys', |
| | 31 | + 'novaproject' => 'Manage OpenStack projects', |
| | 32 | + |
| 26 | 33 | 'openstackmanager-novadomain' => 'Nova Domain', |
| 27 | 34 | 'openstackmanager-novainstance' => 'Nova Instance', |
| 28 | 35 | 'openstackmanager-novakey' => 'Nova Key', |
| — | — | @@ -147,6 +154,11 @@ |
| 148 | 155 | 'openstackmanager-disassociateaddress-confirm' => 'Are you sure you would like to disassociate $1?', |
| 149 | 156 | 'openstackmanager-releaseaddress-confirm' => 'Are you sure you would like to release $1?', |
| 150 | 157 | |
| | 158 | + 'openstackmanager-needsysadminrole' => 'Sysadmin Role Required', |
| | 159 | + 'openstackmanager-needsysadminrole2' => 'You must be a member of the sysadmin role to perform this action.', |
| | 160 | + 'openstackmanager-neednetadminrole' => 'Netadmin Role Required', |
| | 161 | + 'openstackmanager-neednetadminrole2' => 'You must be a member of the netadmin role to perform this action.', |
| | 162 | + |
| 151 | 163 | ); |
| 152 | 164 | |
| 153 | 165 | /** Message documentation (Message documentation) |
| Index: trunk/extensions/OpenStackManager/OpenStackManager.php |
| — | — | @@ -30,6 +30,9 @@ |
| 31 | 31 | $wgExtraNamespaces[NS_VM] = 'VM'; |
| 32 | 32 | $wgExtraNamespaces[NS_VM_TALK] = 'VM_talk'; |
| 33 | 33 | |
| | 34 | +$wgGroupPermissions['sysop']['manageproject'] = true; |
| | 35 | +$wgAvailableRights[] = 'manageproject'; |
| | 36 | + |
| 34 | 37 | $wgOpenStackManagerNovaDisableSSL = true; |
| 35 | 38 | $wgOpenStackManagerNovaServerName = 'localhost'; |
| 36 | 39 | $wgOpenStackManagerNovaPort = 8773; |
| — | — | @@ -40,6 +43,11 @@ |
| 41 | 44 | $wgOpenStackManagerLDAPUser = ''; |
| 42 | 45 | $wgOpenStackManagerLDAPUserPassword = ''; |
| 43 | 46 | $wgOpenStackManagerLDAPProjectBaseDN = ''; |
| | 47 | +$wgOpenStackManagerLDAPGlobalRoles = array( |
| | 48 | + 'sysadmin' => '', |
| | 49 | + 'netadmin' => '', |
| | 50 | + 'cloudadmin' => '', |
| | 51 | + ); |
| 44 | 52 | $wgOpenStackManagerLDAPInstanceBaseDN = ''; |
| 45 | 53 | $wgOpenStackManagerLDAPDefaultGid = '500'; |
| 46 | 54 | $wgOpenStackManagerDNSServers = array( 'primary' => 'localhost', 'secondary' => 'localhost' ); |
| — | — | @@ -72,15 +80,15 @@ |
| 73 | 81 | $wgAutoloadClasses['OpenStackNovaHostJob'] = $dir . 'OpenStackNovaHostJob.php'; |
| 74 | 82 | $wgAutoloadClasses['AmazonEC2'] = $dir . 'aws-sdk/sdk.class.php'; |
| 75 | 83 | $wgSpecialPages['NovaInstance'] = 'SpecialNovaInstance'; |
| 76 | | -$wgSpecialPageGroups['NovaInstance'] = 'other'; |
| | 84 | +$wgSpecialPageGroups['NovaInstance'] = 'nova'; |
| 77 | 85 | $wgSpecialPages['NovaKey'] = 'SpecialNovaKey'; |
| 78 | | -$wgSpecialPageGroups['NovaKey'] = 'other'; |
| | 86 | +$wgSpecialPageGroups['NovaKey'] = 'nova'; |
| 79 | 87 | $wgSpecialPages['NovaProject'] = 'SpecialNovaProject'; |
| 80 | | -$wgSpecialPageGroups['NovaProject'] = 'other'; |
| | 88 | +$wgSpecialPageGroups['NovaProject'] = 'nova'; |
| 81 | 89 | $wgSpecialPages['NovaDomain'] = 'SpecialNovaDomain'; |
| 82 | | -$wgSpecialPageGroups['NovaDomain'] = 'other'; |
| | 90 | +$wgSpecialPageGroups['NovaDomain'] = 'nova'; |
| 83 | 91 | $wgSpecialPages['NovaAddress'] = 'SpecialNovaAddress'; |
| 84 | | -$wgSpecialPageGroups['NovaAddress'] = 'other'; |
| | 92 | +$wgSpecialPageGroups['NovaAddress'] = 'nova'; |
| 85 | 93 | $wgJobClasses['addDNSHostToLDAP'] = 'OpenStackNovaHostJob'; |
| 86 | 94 | |
| 87 | 95 | $wgHooks['LDAPSetCreationValues'][] = 'OpenStackNovaUser::LDAPSetCreationValues'; |
| Index: trunk/extensions/OpenStackManager/OpenStackNovaProject.php |
| — | — | @@ -117,6 +117,15 @@ |
| 118 | 118 | } |
| 119 | 119 | } |
| 120 | 120 | |
| | 121 | + static function getProjectByName( $projectname ) { |
| | 122 | + $project = new OpenStackNovaProject( $projectname ); |
| | 123 | + if ( $project->projectInfo ) { |
| | 124 | + return $project; |
| | 125 | + } else { |
| | 126 | + return null; |
| | 127 | + } |
| | 128 | + } |
| | 129 | + |
| 121 | 130 | static function getAllProjects() { |
| 122 | 131 | global $wgAuth; |
| 123 | 132 | global $wgOpenStackManagerLDAPUser, $wgOpenStackManagerLDAPUserPassword; |