openstack policy 鉴权过程分析

"admin_or_owner": "is_admin:True or project_id:%(project_id)s",

    @wrap_check_policy
    @check_instance_lock
    @check_instance_cell
    @check_instance_state(vm_state=[vm_states.ACTIVE, vm_states.STOPPED],
                          task_state=[None])
    def resize(self, context, instance, flavor_id=None,
               **extra_instance_updates):

def check_policy(context, action, target, scope=‘compute‘):
        _action = ‘%s:%s‘ % (scope, action)  ##这里拼接成policy.json的rule，即_action=compute:resize
        nova.policy.enforce(context, _action, target) 
------------------------------------------------------------------------------------------------------------------------
    def enforce(context, action, target, do_raise=True):
        """Verifies that the action is valid on the target in this context.

           :param context: nova context
           :param action: string representing the action to be checked
               this should be colon separated for clarity.
               i.e. ``compute:create_instance``,
               ``compute:attach_volume``,
               ``volume:attach_volume``
           :param target: dictionary representing the object of the action
               for object creation this should be a dictionary representing the
               location of the object e.g. ``{‘project_id‘: context.project_id}``
           :param do_raise: if True (the default), raises PolicyNotAuthorized;
               if False, returns False

           :raises nova.exception.PolicyNotAuthorized: if verification fails
               and do_raise is True.

           :return: returns a non-False value (not necessarily "True") if
               authorized, and the exact value False if not authorized and
               do_raise is False.
        """
        init()   ##policy.json被cache到cache_info数据结构中，init()函数就是去检查policy.json是否已经被加载或修改过，如果cache_info结构为空，说明policy.json还没有加载过，则执行加载；如果policy.json被修改过，也会重新进行加载

        credentials = context.to_dict()  ##将context转化成dictonary，就是上面context给出的内容，以便后面代码使用

        # Add the exception arguments if asked to do a raise
        extra = {}
        if do_raise:
            extra.update(exc=exception.PolicyNotAuthorized, action=action)  ##增加no auth hook函数，即如果rule的结果为False，则执行no auth hook函数做一些处理

        return policy.check(action, target, credentials, **extra)  ##进行policy的check
--------------------------------------------------------------------------------------------------------------------
def init():
    global _POLICY_PATH
    global _POLICY_CACHE
    if not _POLICY_PATH:
        _POLICY_PATH = CONF.policy_file
        if not os.path.exists(_POLICY_PATH):
            _POLICY_PATH = CONF.find_file(_POLICY_PATH)
        if not _POLICY_PATH:
            raise exception.ConfigNotFound(path=CONF.policy_file)
    utils.read_cached_file(_POLICY_PATH, _POLICY_CACHE,
                           reload_func=_set_rules) ##加载policy.json文件
----------------------------------------------------------------------------------------------------------------------

def read_cached_file(filename, cache_info, reload_func=None):
    """Read from a file if it has been modified.

    :param cache_info: dictionary to hold opaque cache.
    :param reload_func: optional function to be called with data when
                        file is reloaded due to a modification.

    :returns: data from file

    """
    mtime = os.path.getmtime(filename)  ###获取policy.json文件的modify time，如果与cache_info中的mtime不同，则说明文件被修改过，则执行重新加载
    if not cache_info or mtime != cache_info.get(‘mtime‘):
        LOG.debug(_("Reloading cached file %s") % filename)
        with open(filename) as fap:
            cache_info[‘data‘] = fap.read()
        cache_info[‘mtime‘] = mtime
        if reload_func:
            reload_func(cache_info[‘data‘])
    return cache_info[‘data‘]            ###返回加载后的policy.json文件的内容
---------------------------------------------------------------------------------------------------------------------------
def check(rule, target, creds, exc=None, *args, **kwargs):
    """
    Checks authorization of a rule against the target and credentials.

    :param rule: The rule to evaluate.
    :param target: As much information about the object being operated
                   on as possible, as a dictionary.
    :param creds: As much information about the user performing the
                  action as possible, as a dictionary.
    :param exc: Class of the exception to raise if the check fails.
                Any remaining arguments passed to check() (both
                positional and keyword arguments) will be passed to
                the exception class. If exc is not provided, returns
                False.

    :return: Returns False if the policy does not allow the action and
             exc is not provided; otherwise, returns a value that
             evaluates to True. Note: for rules using the "case"
             expression, this True value will be the specified string
             from the expression.
    """

    # Allow the rule to be a Check tree
    if isinstance(rule, BaseCheck):
        result = rule(target, creds)
    elif not _rules:
        # No rules to reference means we‘re going to fail closed
        result = False
    else:
        try:
            # Evaluate the rule
            result = _rules[rule](target, creds)  ##没一条rule执行一个函数，这个对应关系记录在全局变量_rules
        except KeyError:
            # If the rule doesn‘t exist, fail closed
            result = False

    # If it is False, raise the exception if requested
    if exc and result is False:
        raise exc(*args, **kwargs)

    return result