Changes between Version 4 and Version 5 of WikiStart

Timestamp:

May 17, 2013 10:38:29 AM (11 years ago)

Author:

faber

Comment:

--

WikiStart

@@ -173 +173 @@
 
 print "%s %s %s" % (id.keyid(), id1.keyid(), id2.keyid())
-
+}}}
+
+Libabac generates self-signed certificates and does not check the signatures of imported certificates.  Use an external library to do that.
+
+=== Attributes ===
+
+Attributes are the signed ABAC statements that make up proofs.  libabac can import them from files and generate new ones.  This section describes creating them.
+
+[http://groups.geni.net/geni/wiki/TIEDABACModel As we have seen], an ABAC statement assigns an attribute (signed by an identity) to another identity or set of identities with a given attribute.  Here is how libabac constructs an attribute encoding {{{A.admin <- B}}}.  That attirbute means that identity A is assigning identity B the {{{admin}}} attribute for use in later proofs.
+
+{{{
+import ABAC
+
+a = ABAC.ID("A", 24 * 3600 * 365 * 20)
+b = ABAC.ID("B", 24 * 3600 * 365 * 20)
+
+attr = ABAC.Attribute(a, "admin", 24 * 3600 * 365 * 20)
+attr.principal(b.keyid())
+attr.bake()
+
+attr.write_name("attr.xml")
+}}}
+
+The Attribute constructor takes the issuing identity, the attribute being assigned and the validity period of the assertion (in seconds).  This code assigns a principal to that class using the {{{principal}}} member.  The {{{role}}} member and {{{linking_role}}} members can be used to construct the other kinds of attributes.
+
+The {{{bake}}} member finalizes the attribute and creates a signed format for export, which one can write using the {{{write}}} and {{{write_name}}} members, that are analogous to {{{write_cert}}} and {{{write_cert_name}}} members of identities.
+
+The {{{bake}}} method exists so that Attributes can contain conjunctions.  If identity A wants to state that friendly admins are admins who are friendly ({{{A.friendly_admin <- A.friendly & A.admin}}}), this code will it:
+
+{{{
+import ABAC
+
+a = ABAC.ID("A", 24 * 3600 * 365 * 20)
+
+attr = ABAC.Attribute(a, "friendly_admin", 24 * 3600 * 365 * 20)
+attr.role(a.keyid(), "friendly")
+attr.role(a.keyid(), "admin")
+attr.bake()
+
+attr.write_name("attr.xml")
 
 }}}