/ 
PlugAuth-0.39
River stage zero No dependents
/ PlugAuth::Plugin::FlatAuthz

NAME

PlugAuth::Plugin::FlatAuthz - Authorization using flat files for PlugAuth

VERSION

version 0.39

SYNOPSIS

In your /etc/PlugAuth.conf

---
url: http://localhost:1234
group_file: /etc/plugauth/group.txt
resource_file: /etc/plugauth/resource.txt
host_file: /etc/plugauth/host.txt

touch the storage files:

% touch /etc/plugauth/group.txt \
        /etc/plugauth/resource.txt \
        /etc/plugauth/host.txt

Start PlugAuth:

% plugauth start

DESCRIPTION

This is the default Authorization plugin for PlugAuth. It is designed to work closely with PlugAuth::Plugin::FlatAuth which is the default Authentication plugin.

This plugin provides storage for groups, hosts and access control for PlugAuth. In addition it provides a mechanism for PlugAuth to alter the group, host and access control databases.

CONFIGURATION

group_file

The group file looks similar to a standard UNIX /etc/group file. Entries can be changed using either your favorite editor, or by using PlugAuth::Client. In this example there is a group both to which both bob and alice belong:

both: alice, bob

Group members can be specified using a glob (see Text::Glob) which match against the set of all users:

all: *

Each user automatically gets his own group, so if there are users named bob and alice, this is unnecessary:

alice: alice
bob: bob

resource_file

Each line of resource.txt has a resource, an action (in parentheses), and then a list of users or groups. The line grants permission for those groups to perform that action on that resource :

/house/door (enter) : alice, bob
/house/backdoor (enter) : both
/house/window (break) : alice
/house (GET) : bob

host_file

The host file /etc/pluginauth/host.txt looks like this :

192.168.1.99:trusted
192.168.1.100:trusted

The IP addresses on the right represent hosts from which authorization should succeed.

METHODS

PlugAuth::Plugin::FlatAuthz->refresh

Refresh the data (checks the files, and re-reads if necessary).

PlugAuth::Plugin::FlatAuthz->can_user_action_resource( $user, $action, $resource )

If $user can perform $action on $resource, return a string containing the group and resource that permits this. Otherwise, return false.

PlugAuth::Plugin::FlatAuthz->match_resources( $regex )

Given a regex, return all resources that match that regex.

PlugAuth::Plugin::FlatAuthz->host_has_tag( $host, $tag )

Returns true if the given host has the given tag.

PlugAuth::Plugin::FlatAuthz->actions

Returns a list of actions.

PlugAuth::Plugin::FlatAuthz->groups_for_user( $user )

Returns the groups the given user belongs to as a list ref. Returns undef if the user does not exist.

PlugAuth::Plugin::FlatAuthz->all_groups

Returns a list of all groups.

PlugAuth::Plugin::FlatAuthz->users_in_group( $group )

Return the list of users (as an array ref) that belong to the given group. Each user belongs to a special group that is the same as their user name and just contains themselves, and this will be included in the list.

Returns undef if the group does not exist.

PlugAuth::Plugin::FlatAuthz->create_group( $group, $users )

Create a new group with the given users. $users is a comma separated list of user names.

PlugAuth::Plugin::FlatAuthz->delete_group( $group )

Delete the given group.

PlugAuth::Plugin::FlatAuthz->update_group( $group, $users )

Update the given group, setting the set of users that belong to that group. The existing group membership will be replaced with the new one. $users is a comma separated list of user names.

PlugAuth::Plugin::FlatAuthz->add_user_to_group( $group, $user )

Add the given user to the given group.

PlugAuth::Plugin::FlatAuthz->remove_user_from_group( $group, $user )

Remove the given user from the given group

PlugAuth::Plugin::FlatAuthz->grant( $group, $action, $resource )

Grant the given group or user ($group) the authorization to perform the given action ($action) on the given resource ($resource).

PlugAuth::Plugin::FlatAuthz->revoke( $group, $action, $resource )

Revoke the given group or user ($group) the authorization to perform the given action ($action) on the given resource ($resource).

$plugin->granted

Returns a list of granted permissions

SEE ALSO

PlugAuth, PlugAuth::Plugin::FlatAuth

AUTHOR

Graham Ollis <gollis@sesda3.com>

COPYRIGHT AND LICENSE

This software is copyright (c) 2012 by NASA GSFC.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.