kmip/services/server/engine.py
def is_allowed(
            self,
            policy_name,
            session_user,
            session_group,
            object_owner,
            object_type,
            operation
    ):
        """
        Determine if object access is allowed for the provided policy and
        session settings.
        """
        policy_section = self.get_relevant_policy_section(
            policy_name,
            session_group
        )
        if policy_section is None:
            return False

        object_policy = policy_section.get(object_type)
        if not object_policy:
            self._logger.warning(
                "The '{0}' policy does not apply to {1} objects.".format(
                    policy_name,
                    self._get_enum_string(object_type)
                )
            )
            return False

        operation_object_policy = object_policy.get(operation)
        if not operation_object_policy:
            self._logger.warning(
                "The '{0}' policy does not apply to {1} operations on {2} "
                "objects.".format(
                    policy_name,
                    self._get_enum_string(operation),
                    self._get_enum_string(object_type)
                )
            )
            return False

        if operation_object_policy == enums.Policy.ALLOW_ALL:
            return True
        elif operation_object_policy == enums.Policy.ALLOW_OWNER:
            if session_user == object_owner:
                return True
            else:
                return False
        elif operation_object_policy == enums.Policy.DISALLOW_ALL:
            return False
        else:
            return False
def is_allowed(
            self,
            policy_name,
            session_user,
            session_group,
            object_owner,
            object_type,
            operation
    ):
        policy_section = self.get_relevant_policy_section(
            policy_name,
            session_group
        )
        if policy_section is None:
            return False

        object_policy = policy_section.get(object_type)
        if not object_policy:
            self._logger.warning(
                "The '{0}' policy does not apply to {1} objects.".format(
                    policy_name,
                    self._get_enum_string(object_type)
                )
            )
            return False

        operation_object_policy = object_policy.get(operation)
        if not operation_object_policy:
            self._logger.warning(
                "The '{0}' policy does not apply to {1} operations on {2} "
                "objects.".format(
                    policy_name,
                    self._get_enum_string(operation),
                    self._get_enum_string(object_type)
                )
            )
            return False

        if operation_object_policy == enums.Policy.ALLOW_ALL:
            return True
        elif operation_object_policy == enums.Policy.ALLOW_OWNER:
            if session_user == object_owner:
                return True
            else:
                return False
        elif operation_object_policy == enums.Policy.DISALLOW_ALL:
            return False
        else:
            return False
def is_allowed ( self , policy_name , session_user , session_group , object_owner , object_type , operation ) : policy_section = self . get_relevant_policy_section ( policy_name , session_group ) if policy_section is None : return False object_policy = policy_section . get ( object_type ) if not object_policy : self . _logger . warning ( "The '{0}' policy does not apply to {1} objects." . format ( policy_name , self . _get_enum_string ( object_type ) ) ) return False operation_object_policy = object_policy . get ( operation ) if not operation_object_policy : self . _logger . warning ( "The '{0}' policy does not apply to {1} operations on {2} " "objects." . format ( policy_name , self . _get_enum_string ( operation ) , self . _get_enum_string ( object_type ) ) ) return False if operation_object_policy == enums . Policy . ALLOW_ALL : return True elif operation_object_policy == enums . Policy . ALLOW_OWNER : if session_user == object_owner : return True else : return False elif operation_object_policy == enums . Policy . DISALLOW_ALL : return False else : return False
Determine if object access is allowed for the provided policy and
        session settings.
Determine if object access is allowed for the provided policy and session settings .