Merge lp:~gholt/swift/authlock into lp:~hudson-openstack/swift/trunk

[gholt]

Locking down the DevAuth by adding support for a super admin and reseller admins.

Locking down the DevAuth:

There are two new classes of users, super admin and reseller admin, for a total of four now:

user
    Standard user, only has access to containers if they are specifically listed in the containers' ACLs.

account admin
    Has full access within a single account. Can also create additional standard users and account admins.

reseller admin
    Is treated as an account admin for all accounts with the reseller's prefix. Can also create additional account admins for any account with the reseller's prefix. Cannot create additional reseller admins.

super admin
    Has the same access as the reseller admin and can create additional reseller admins. Also can issue a "recreate accounts" call.

Tool changes:

swift-auth-add-user:
    Accepts new options: -r to make the user a reseller admin, -U and -K to define the admin issuing the request. Simplest change to existing usage: "swift-auth-add-user account user key" becomes "swift-auth-add-user -K devauth account user key"

swift-auth-recreate-accounts:
    Refactored to use optparse. Accepts new options: -c for the auth-server.conf location, -U -K to define the admin issuing the request (must be super admin at the moment). Simplest change to existing usage: "swift-auth-recreate-accounts" becomes "swift-auth-recreate-accounts -K devauth"

Code changes:

swift/auth/server.py:
    No longer needs the account ring or access to backend account servers; instead it creates accounts through a normal PUT request to the proxy server. So now it can be running anywhere and actually work with multiple clusters if needed.
    Requires a super_admin_key be set in the conf file, allowing the permission set indicated above.
    Supports creating reseller admins.
    Everything is locked down as specified above.
    Can return a special group named .reseller_admin to the auth middleware, indicating that account PUTs are allowed by the user.

swift/common/middware/auth.py:
    Just changed to lockdown the new account PUT facility to just .reseller_admin and to treat .reseller_admin as also an account admin.

swift/proxy/server.py:
    Supports account PUTs. Moved MAX_CONTAINER_NAME_LENGTH to swift/common/constraints.py

And, of course, doc and test updates.

[gholt (gholt)]

The implementation is done, existing tests and documentation has been updated. Just need tests and docs for new functionality.

[Chuck Thier (cthier)]

Looks good to me

review: Approve

=== modified file 'bin/swift-auth-add-user'
--- bin/swift-auth-add-user	2010-09-06 02:53:08 +0000
+++ bin/swift-auth-add-user	2010-09-12 00:25:58 +0000
@@ -33,6 +33,16 @@
         default=False, help='Give the user administrator access; otherwise '
         'the user will only have access to containers specifically allowed '
         'with ACLs.')
+    parser.add_option('-r', '--reseller-admin', dest='reseller_admin',
+        action='store_true', default=False, help='Give the user full reseller '
+        'administrator access, giving them full access to all accounts within '
+        'the reseller, including the ability to create new accounts. Creating '
+        'a new reseller admin requires super_admin rights.')
+    parser.add_option('-U', '--admin-user', dest='admin_user',
+        default='.super_admin', help='The user with admin rights to add users '
+        '(default: .super_admin).')
+    parser.add_option('-K', '--admin-key', dest='admin_key',
+        help='The key for the user with admin rights to add users.')
     args = argv[1:]
     if not args:
         args.append('-h')
@@ -48,9 +58,13 @@
     port = int(conf.get('bind_port', 11000))
     ssl = conf.get('cert_file') is not None
     path = '/account/%s/%s' % (account, user)
-    headers = {'X-Auth-User-Key': password}
+    headers = {'X-Auth-Admin-User': options.admin_user,
+               'X-Auth-Admin-Key': options.admin_key,
+               'X-Auth-User-Key': password}
     if options.admin:
         headers['X-Auth-User-Admin'] = 'true'
+    if options.reseller_admin:
+        headers['X-Auth-User-Reseller-Admin'] = 'true'
     conn = http_connect(host, port, 'PUT', path, headers, ssl=ssl)
     resp = conn.getresponse()
     if resp.status == 204:
 
=== modified file 'bin/swift-auth-recreate-accounts'
--- bin/swift-auth-recreate-accounts	2010-08-20 00:50:12 +0000
+++ bin/swift-auth-recreate-accounts	2010-09-12 00:25:58 +0000
@@ -15,25 +15,37 @@
 # limitations under the License.
 
 from ConfigParser import ConfigParser
+from optparse import OptionParser
 from sys import argv, exit
 
 from swift.common.bufferedhttp import http_connect_raw as http_connect
 
 if __name__ == '__main__':
-    f = '/etc/swift/auth-server.conf'
-    if len(argv) == 2:
-        f = argv[1]
-    elif len(argv) != 1:
-        exit('Syntax: %s [conf_file]' % argv[0])
+    default_conf = '/etc/swift/auth-server.conf'
+    parser = OptionParser(usage='Usage: %prog [options]')
+    parser.add_option('-c', '--conf', dest='conf', default=default_conf,
+        help='Configuration file to determine how to connect to the local '
+        'auth server (default: %s).' % default_conf)
+    parser.add_option('-U', '--admin-user', dest='admin_user',
+        default='.super_admin', help='The user with admin rights to recreate '
+        'accounts (default: .super_admin).')
+    parser.add_option('-K', '--admin-key', dest='admin_key',
+        help='The key for the user with admin rights to recreate accounts.')
+    args = argv[1:]
+    if not args:
+        args.append('-h')
+    (options, args) = parser.parse_args(args)
     c = ConfigParser()
-    if not c.read(f):
-        exit('Unable to read conf file: %s' % f)
+    if not c.read(options.conf):
+        exit('Unable to read conf file: %s' % options.conf)
     conf = dict(c.items('app:auth-server'))
     host = conf.get('bind_ip', '127.0.0.1')
     port = int(conf.get('bind_port', 11000))
     ssl = conf.get('cert_file') is not None
     path = '/recreate_accounts'
-    conn = http_connect(host, port, 'POST', path, ssl=ssl)
+    conn = http_connect(host, port, 'POST', path, ssl=ssl,
+            headers={'X-Auth-Admin-User': options.admin_user,
+                     'X-Auth-Admin-Key': options.admin_key})
     resp = conn.getresponse()
     if resp.status == 200:
         print resp.read()
 
=== modified file 'doc/source/development_auth.rst'
--- doc/source/development_auth.rst	2010-09-09 17:24:25 +0000
+++ doc/source/development_auth.rst	2010-09-12 00:25:58 +0000
@@ -6,10 +6,13 @@
 Creating Your Own Auth Server and Middleware
 --------------------------------------------
 
-The included swift/common/middleware/auth.py is a good minimal example of how
-to create auth middleware. The main points are that the auth middleware can
-reject requests up front, before they ever get to the Swift Proxy application,
-and afterwards when the proxy issues callbacks to verify authorization.
+The included swift/auth/server.py and swift/common/middleware/auth.py are good
+minimal examples of how to create an external auth server and proxy server auth
+middleware. Also, see the `Swauth <https://launchpad.net/swauth>`_ project for
+a more complete implementation. The main points are that the auth middleware
+can reject requests up front, before they ever get to the Swift Proxy
+application, and afterwards when the proxy issues callbacks to verify
+authorization.
 
 It's generally good to separate the authentication and authorization
 procedures. Authentication verifies that a request actually comes from who it
 
=== modified file 'doc/source/development_saio.rst'
--- doc/source/development_saio.rst	2010-09-06 02:53:08 +0000
+++ doc/source/development_saio.rst	2010-09-12 00:25:58 +0000
@@ -177,6 +177,8 @@
         [app:auth-server]
         use = egg:swift#auth
         default_cluster_url = http://127.0.0.1:8080/v1
+        # Highly recommended to change this.
+        super_admin_key = devauth
 
   #. Create `/etc/swift/proxy-server.conf`::
 
@@ -511,7 +513,9 @@
 
         #!/bin/bash
 
-        swift-auth-recreate-accounts
+        # Replace devauth with whatever your super_admin key is (recorded in
+        # /etc/swift/auth-server.conf).
+        swift-auth-recreate-accounts -K devauth
         swift-init object-updater start
         swift-init container-updater start
         swift-init object-replicator start
@@ -526,12 +530,12 @@
   #. `remakerings`
   #. `cd ~/swift/trunk; ./.unittests`
   #. `startmain` (The ``Unable to increase file descriptor limit.  Running as non-root?`` warnings are expected and ok.)
-  #. `swift-auth-add-user --admin test tester testing`
+  #. `swift-auth-add-user -K devauth -a test tester testing` # Replace ``devauth`` with whatever your super_admin key is (recorded in /etc/swift/auth-server.conf).
   #. Get an `X-Storage-Url` and `X-Auth-Token`: ``curl -v -H 'X-Storage-User: test:tester' -H 'X-Storage-Pass: testing' http://127.0.0.1:11000/v1.0``
   #. Check that you can GET account: ``curl -v -H 'X-Auth-Token: <token-from-x-auth-token-above>' <url-from-x-storage-url-above>``
   #. Check that `st` works: `st -A http://127.0.0.1:11000/v1.0 -U test:tester -K testing stat`
-  #. `swift-auth-add-user --admin test2 tester2 testing2`
-  #. `swift-auth-add-user test tester3 testing3`
+  #. `swift-auth-add-user -K devauth -a test2 tester2 testing2` # Replace ``devauth`` with whatever your super_admin key is (recorded in /etc/swift/auth-server.conf).
+  #. `swift-auth-add-user -K devauth test tester3 testing3` # Replace ``devauth`` with whatever your super_admin key is (recorded in /etc/swift/auth-server.conf).
   #. `cp ~/swift/trunk/test/functional/sample.conf /etc/swift/func_test.conf`
   #. `cd ~/swift/trunk; ./.functests` (Note: functional tests will first delete
      everything in the configured accounts.)
 
=== modified file 'doc/source/howto_cyberduck.rst'
--- doc/source/howto_cyberduck.rst	2010-09-06 02:21:08 +0000
+++ doc/source/howto_cyberduck.rst	2010-09-12 00:25:58 +0000
@@ -90,26 +90,43 @@
 
 #.  Example proxy-server config::
 
-        [proxy-server]
-        bind_port = 8080
-        user = swift
+        [DEFAULT]
         cert_file = /etc/swift/cert.crt
         key_file = /etc/swift/cert.key
-
-        [auth-server]
+        
+        [pipeline:main]
+        pipeline = healthcheck cache auth proxy-server
+        
+        [app:proxy-server]
+        use = egg:swift#proxy
+        
+        [filter:auth]
+        use = egg:swift#auth
         ssl = true
+        
+        [filter:healthcheck]
+        use = egg:swift#healthcheck
+        
+        [filter:cache]
+        use = egg:swift#memcache
 
 #.  Example auth-server config::
 
-        [auth-server]
+        [DEFAULT]
+        cert_file = /etc/swift/cert.crt
+        key_file = /etc/swift/cert.key
+        
+        [pipeline:main]
+        pipeline = auth-server
+        
+        [app:auth-server]
+        use = egg:swift#auth
+        super_admin_key = devauth
         default_cluster_url = https://ec2-184-72-156-130.compute-1.amazonaws.com:8080/v1
-        user = swift
-        cert_file = /etc/swift/cert.crt
-        key_file = /etc/swift/cert.key
 
 #.  Use swift-auth-add-user to create a new account and admin user::
 
-        ubuntu@domU-12-31-39-03-CD-06:/home/swift/swift/bin$ swift-auth-add-user --admin a3 b3 c3
+        ubuntu@domU-12-31-39-03-CD-06:/home/swift/swift/bin$ swift-auth-add-user -K devauth -a a3 b3 c3
         https://ec2-184-72-156-130.compute-1.amazonaws.com:8080/v1/06228ccf-6d0a-4395-889e-e971e8de8781
 
     .. note::
 
=== modified file 'etc/auth-server.conf-sample'
--- etc/auth-server.conf-sample	2010-08-24 14:08:16 +0000
+++ etc/auth-server.conf-sample	2010-09-12 00:25:58 +0000
@@ -12,6 +12,8 @@
 
 [app:auth-server]
 use = egg:swift#auth
+# Highly recommended to change this.
+super_admin_key = devauth
 # log_name = auth-server
 # log_facility = LOG_LOCAL0
 # log_level = INFO
 
=== modified file 'swift/auth/server.py'
--- swift/auth/server.py	2010-09-09 17:24:25 +0000
+++ swift/auth/server.py	2010-09-12 00:25:58 +0000
@@ -14,23 +14,21 @@
 # limitations under the License.
 
 from __future__ import with_statement
-import errno
 import os
-import socket
 from contextlib import contextmanager
 from time import gmtime, strftime, time
 from urllib import unquote, quote
 from uuid import uuid4
+from urlparse import urlparse
 
 import sqlite3
 from webob import Request, Response
-from webob.exc import HTTPBadRequest, HTTPNoContent, HTTPUnauthorized, \
-                      HTTPServiceUnavailable, HTTPNotFound
+from webob.exc import HTTPBadRequest, HTTPForbidden, HTTPNoContent, \
+    HTTPUnauthorized, HTTPServiceUnavailable, HTTPNotFound
 
-from swift.common.bufferedhttp import http_connect
+from swift.common.bufferedhttp import http_connect_raw as http_connect
 from swift.common.db import get_db_connection
-from swift.common.ring import Ring
-from swift.common.utils import get_logger, normalize_timestamp, split_path
+from swift.common.utils import get_logger, split_path
 
 
 class AuthController(object):
@@ -69,8 +67,7 @@
 
     * The developer makes a ReST call to create a new user.
     * If the account for the user does not yet exist, the auth server makes
-      ReST calls to the Swift cluster's account servers to create a new account
-      on its end.
+      a ReST call to the Swift cluster to create a new account on its end.
     * The auth server records the information in its database.
 
     A last use case is recreating existing accounts; this is really only useful
@@ -78,34 +75,34 @@
     the auth server's database is retained:
 
     * A developer makes an ReST call to have the existing accounts recreated.
-    * For each account in its database, the auth server makes ReST calls to
-      the Swift cluster's account servers to create a specific account on its
-      end.
+    * For each account in its database, the auth server makes a ReST call to
+      the Swift cluster to create the specific account on its end.
 
     :param conf: The [auth-server] dictionary of the auth server configuration
                  file
-    :param ring: Overrides loading the account ring from a file; useful for
-                 testing.
 
     See the etc/auth-server.conf-sample for information on the possible
     configuration parameters.
     """
 
-    def __init__(self, conf, ring=None):
+    def __init__(self, conf):
         self.logger = get_logger(conf)
+        self.super_admin_key = conf.get('super_admin_key')
+        if not self.super_admin_key:
+            msg = 'No super_admin_key set in conf file! Exiting.'
+            try:
+                self.logger.critical(msg)
+            except:
+                pass
+            raise ValueError(msg)
         self.swift_dir = conf.get('swift_dir', '/etc/swift')
         self.reseller_prefix = conf.get('reseller_prefix', 'AUTH').strip()
         if self.reseller_prefix and self.reseller_prefix[-1] != '_':
             self.reseller_prefix += '_'
-        self.default_cluster_url = \
-            conf.get('default_cluster_url', 'http://127.0.0.1:8080/v1')
+        self.default_cluster_url = conf.get('default_cluster_url',
+                                    'http://127.0.0.1:8080/v1').rstrip('/')
         self.token_life = int(conf.get('token_life', 86400))
         self.log_headers = conf.get('log_headers') == 'True'
-        if ring:
-            self.account_ring = ring
-        else:
-            self.account_ring = \
-                Ring(os.path.join(self.swift_dir, 'account.ring.gz'))
         self.db_file = os.path.join(self.swift_dir, 'auth.db')
         self.conn = get_db_connection(self.db_file, okay_to_create=True)
         try:
@@ -114,9 +111,16 @@
             if str(err) == 'no such column: admin':
                 self.conn.execute("ALTER TABLE account ADD COLUMN admin TEXT")
                 self.conn.execute("UPDATE account SET admin = 't'")
+        try:
+            self.conn.execute('SELECT reseller_admin FROM account LIMIT 1')
+        except sqlite3.OperationalError, err:
+            if str(err) == 'no such column: reseller_admin':
+                self.conn.execute(
+                    "ALTER TABLE account ADD COLUMN reseller_admin TEXT")
         self.conn.execute('''CREATE TABLE IF NOT EXISTS account (
                                 account TEXT, url TEXT, cfaccount TEXT,
-                                user TEXT, password TEXT, admin TEXT)''')
+                                user TEXT, password TEXT, admin TEXT,
+                                reseller_admin TEXT)''')
         self.conn.execute('''CREATE INDEX IF NOT EXISTS ix_account_account
                              ON account (account)''')
         try:
@@ -139,51 +143,36 @@
 
     def add_storage_account(self, account_name=''):
         """
-        Creates an account within the Swift cluster by making a ReST call to
-        each of the responsible account servers.
+        Creates an account within the Swift cluster by making a ReST call.
 
         :param account_name: The desired name for the account; if omitted a
                              UUID4 will be used.
         :returns: False upon failure, otherwise the name of the account
                   within the Swift cluster.
         """
-        begin = time()
         orig_account_name = account_name
         if not account_name:
             account_name = '%s%s' % (self.reseller_prefix, uuid4().hex)
-        partition, nodes = self.account_ring.get_nodes(account_name)
-        headers = {'X-Timestamp': normalize_timestamp(time()),
-                   'x-cf-trans-id': 'tx' + str(uuid4())}
-        statuses = []
-        for node in nodes:
-            try:
-                conn = None
-                conn = http_connect(node['ip'], node['port'], node['device'],
-                        partition, 'PUT', '/' + account_name, headers)
-                source = conn.getresponse()
-                statuses.append(source.status)
-                if source.status >= 500:
-                    self.logger.error('ERROR With account server %s:%s/%s: '
-                        'Response %s %s: %s' %
-                        (node['ip'], node['port'], node['device'],
-                         source.status, source.reason, source.read(1024)))
-                conn = None
-            except BaseException, err:
-                log_call = self.logger.exception
-                msg = 'ERROR With account server ' \
-                      '%(ip)s:%(port)s/%(device)s (will retry later): ' % node
-                if isinstance(err, socket.error):
-                    if err[0] == errno.ECONNREFUSED:
-                        log_call = self.logger.error
-                        msg += 'Connection refused'
-                    elif err[0] == errno.EHOSTUNREACH:
-                        log_call = self.logger.error
-                        msg += 'Host unreachable'
-                log_call(msg)
-        rv = False
-        if len([s for s in statuses if (200 <= s < 300)]) > len(nodes) / 2:
-            rv = account_name
-        return rv
+        url = '%s/%s' % (self.default_cluster_url, account_name)
+        parsed = urlparse(url)
+        # Create a single use token.
+        token = '%stk%s' % (self.reseller_prefix, uuid4().hex)
+        with self.get_conn() as conn:
+            conn.execute('''
+                INSERT INTO token
+                (token, created, account, user, cfaccount) VALUES
+                (?, ?, '.super_admin', '.single_use', '.reseller_admin')''',
+                (token, time()))
+            conn.commit()
+        conn = http_connect(parsed.hostname, parsed.port, 'PUT', parsed.path,
+                {'X-Auth-Token': token}, ssl=(parsed.scheme == 'https'))
+        resp = conn.getresponse()
+        resp.read()
+        if resp.status // 100 != 2:
+            self.logger.error('ERROR attempting to create account %s: %s %s' %
+                              (url, resp.status, resp.reason))
+            return False
+        return account_name
 
     @contextmanager
     def get_conn(self):
@@ -229,7 +218,9 @@
 
         :param token: The token to validate
         :returns: (TTL, account, user, cfaccount) if valid, False otherwise.
-                  cfaccount will be None for users without admin access.
+                  cfaccount will be None for users without admin access for the
+                  account. cfaccount will be .reseller_admin for users with
+                  full reseller admin rights.
         """
         begin = time()
         self.purge_old_tokens()
@@ -241,18 +232,20 @@
                 (token,)).fetchone()
             if row is not None:
                 created = row[0]
-                if time() - created >= self.token_life:
+                if time() - created < self.token_life:
+                    rv = (self.token_life - (time() - created), row[1], row[2],
+                          row[3])
+                # Remove the token if it was expired or single use.
+                if not rv or rv[2] == '.single_use':
                     conn.execute('''
                         DELETE FROM token WHERE token = ?''', (token,))
                     conn.commit()
-                else:
-                    rv = (self.token_life - (time() - created), row[1], row[2],
-                          row[3])
         self.logger.info('validate_token(%s, _, _) = %s [%.02f]' %
                          (repr(token), repr(rv), time() - begin))
         return rv
 
-    def create_user(self, account, user, password, admin=False):
+    def create_user(self, account, user, password, admin=False,
+                    reseller_admin=False):
         """
         Handles the create_user call for developers, used to request a user be
         added in the auth server database. If the account does not yet exist,
@@ -274,6 +267,9 @@
         :param admin: If true, the user will be granted full access to the
                       account; otherwise, another user will have to add the
                       user to the ACLs for containers to grant access.
+        :param reseller_admin: If true, the user will be granted full access to
+                               all accounts within this reseller, including the
+                               ability to create additional accounts.
 
         :returns: False if the create fails, 'already exists' if the user
                   already exists, or storage url if successful
@@ -287,9 +283,9 @@
                 (account, user)).fetchone()
             if row:
                 self.logger.info(
-                    'ALREADY EXISTS create_user(%s, %s, _, %s) [%.02f]' %
+                    'ALREADY EXISTS create_user(%s, %s, _, %s, %s) [%.02f]' %
                     (repr(account), repr(user), repr(admin),
-                     time() - begin))
+                     repr(reseller_admin), time() - begin))
                 return 'already exists'
             row = conn.execute(
                 'SELECT url, cfaccount FROM account WHERE account = ?',
@@ -301,21 +297,22 @@
                 account_hash = self.add_storage_account()
                 if not account_hash:
                     self.logger.info(
-                        'FAILED create_user(%s, %s, _, %s) [%.02f]' %
+                        'FAILED create_user(%s, %s, _, %s, %s) [%.02f]' %
                         (repr(account), repr(user), repr(admin),
-                         time() - begin))
+                         repr(reseller_admin), time() - begin))
                     return False
                 url = self.default_cluster_url.rstrip('/') + '/' + account_hash
             conn.execute('''INSERT INTO account
-                (account, url, cfaccount, user, password, admin)
-                VALUES (?, ?, ?, ?, ?, ?)''',
+                (account, url, cfaccount, user, password, admin,
+                 reseller_admin)
+                VALUES (?, ?, ?, ?, ?, ?, ?)''',
                 (account, url, account_hash, user, password,
-                 admin and 't' or ''))
+                 admin and 't' or '', reseller_admin and 't' or ''))
             conn.commit()
         self.logger.info(
-            'SUCCESS create_user(%s, %s, _, %s) = %s [%.02f]' %
-            (repr(account), repr(user), repr(admin), repr(url),
-             time() - begin))
+            'SUCCESS create_user(%s, %s, _, %s, %s) = %s [%.02f]' %
+            (repr(account), repr(user), repr(admin), repr(reseller_admin),
+             repr(url), time() - begin))
         return url
 
     def recreate_accounts(self):
@@ -339,6 +336,32 @@
                          (rv, time() - begin))
         return rv
 
+    def is_account_admin(self, request, for_account):
+        """
+        Returns True if the request represents coming from .super_admin, a
+        .reseller_admin, or an admin for the account specified.
+        """
+        if request.headers.get('X-Auth-Admin-User') == '.super_admin' and \
+               request.headers.get('X-Auth-Admin-Key') == self.super_admin_key:
+            return True
+        try:
+            account, user = \
+                request.headers.get('X-Auth-Admin-User').split(':', 1)
+        except (AttributeError, ValueError):
+            return False
+        with self.get_conn() as conn:
+            row = conn.execute('''
+                SELECT reseller_admin, admin FROM account
+                WHERE account = ? AND user = ? AND password = ?''',
+                (account, user,
+                 request.headers.get('X-Auth-Admin-Key'))).fetchone()
+            if row:
+                if row[0] == 't':
+                    return True
+                if row[1] == 't' and account == for_account:
+                    return True
+        return False
+
     def handle_token(self, request):
         """
         Handles ReST requests from Swift to validate tokens
@@ -362,7 +385,9 @@
         if not validation:
             return HTTPNotFound()
         groups = ['%s:%s' % (validation[1], validation[2]), validation[1]]
-        if validation[3]: # admin access to a cfaccount
+        if validation[3]:
+            # admin access to a cfaccount or ".reseller_admin" to access to all
+            # accounts, including creating new ones.
             groups.append(validation[3])
         return HTTPNoContent(headers={'X-Auth-TTL': validation[0],
                                       'X-Auth-Groups': ','.join(groups)})
@@ -380,6 +405,7 @@
         Valid headers:
             * X-Auth-User-Key: <password>
             * X-Auth-User-Admin: <true|false>
+            * X-Auth-User-Reseller-Admin: <true|false>
 
         If the HTTP request returns with a 204, then the user was added,
         and the storage url will be available in the X-Storage-Url header.
@@ -390,13 +416,24 @@
             _, account_name, user_name = split_path(request.path, minsegs=3)
         except ValueError:
             return HTTPBadRequest()
+        create_reseller_admin = \
+            request.headers.get('x-auth-user-reseller-admin') == 'true'
+        if create_reseller_admin and (
+              request.headers.get('X-Auth-Admin-User') != '.super_admin' or
+              request.headers.get('X-Auth-Admin-Key') != self.super_admin_key):
+            return HTTPForbidden(request=request)
+        create_account_admin = \
+            request.headers.get('x-auth-user-admin') == 'true'
+        if create_account_admin and \
+                not self.is_account_admin(request, account_name):
+            return HTTPForbidden(request=request)
         if 'X-Auth-User-Key' not in request.headers:
-            return HTTPBadRequest('X-Auth-User-Key is required')
+            return HTTPBadRequest(body='X-Auth-User-Key is required')
         password = request.headers['x-auth-user-key']
         storage_url = self.create_user(account_name, user_name, password,
-                        request.headers.get('x-auth-user-admin') == 'true')
+                        create_account_admin, create_reseller_admin)
         if storage_url == 'already exists':
-            return HTTPBadRequest(storage_url)
+            return HTTPBadRequest(body=storage_url)
         if not storage_url:
             return HTTPServiceUnavailable()
         return HTTPNoContent(headers={'x-storage-url': storage_url})
@@ -412,6 +449,9 @@
 
         :param request: webob.Request object
         """
+        if request.headers.get('X-Auth-Admin-User') != '.super_admin' or \
+               request.headers.get('X-Auth-Admin-Key') != self.super_admin_key:
+            return HTTPForbidden(request=request)
         result = self.recreate_accounts()
         return Response(result, 200, request=request)
 
@@ -471,7 +511,7 @@
         self.purge_old_tokens()
         with self.get_conn() as conn:
             row = conn.execute('''
-                SELECT cfaccount, url, admin FROM account
+                SELECT cfaccount, url, admin, reseller_admin FROM account
                 WHERE account = ? AND user = ? AND password = ?''',
                 (account, user, password)).fetchone()
             if row is None:
@@ -479,6 +519,7 @@
             cfaccount = row[0]
             url = row[1]
             admin = row[2] == 't'
+            reseller_admin = row[3] == 't'
             row = conn.execute('''
                 SELECT token FROM token WHERE account = ? AND user = ?''',
                 (account, user)).fetchone()
@@ -486,11 +527,16 @@
                 token = row[0]
             else:
                 token = '%stk%s' % (self.reseller_prefix, uuid4().hex)
+                token_cfaccount = ''
+                if admin:
+                    token_cfaccount = cfaccount
+                if reseller_admin:
+                    token_cfaccount = '.reseller_admin'
                 conn.execute('''
                     INSERT INTO token
                     (token, created, account, user, cfaccount)
                     VALUES (?, ?, ?, ?, ?)''',
-                    (token, time(), account, user, admin and cfaccount or ''))
+                    (token, time(), account, user, token_cfaccount))
                 conn.commit()
             return HTTPNoContent(headers={'x-auth-token': token,
                                           'x-storage-token': token,
 
=== modified file 'swift/common/constraints.py'
--- swift/common/constraints.py	2010-08-16 22:30:27 +0000
+++ swift/common/constraints.py	2010-09-12 00:25:58 +0000
@@ -36,6 +36,8 @@
 CONTAINER_LISTING_LIMIT = 10000
 #: Max container list length of a get request for an account
 ACCOUNT_LISTING_LIMIT = 10000
+MAX_ACCOUNT_NAME_LENGTH = 256
+MAX_CONTAINER_NAME_LENGTH = 256
 
 
 def check_metadata(req, target_type):
 
=== modified file 'swift/common/middleware/auth.py'
--- swift/common/middleware/auth.py	2010-09-09 17:24:25 +0000
+++ swift/common/middleware/auth.py	2010-09-12 00:25:58 +0000
@@ -49,7 +49,7 @@
         token = env.get('HTTP_X_AUTH_TOKEN', env.get('HTTP_X_STORAGE_TOKEN'))
         if token and token.startswith(self.reseller_prefix):
             memcache_client = cache_from_env(env)
-            key = 'devauth/%s' % token
+            key = '%s/token/%s' % (self.reseller_prefix, token)
             cached_auth_data = memcache_client.get(key)
             if cached_auth_data:
                 start, expiration, groups = cached_auth_data
@@ -85,14 +85,19 @@
         version, account, container, obj = split_path(req.path, 1, 4, True)
         if not account or not account.startswith(self.reseller_prefix):
             return self.denied_response(req)
-        if req.remote_user and account in req.remote_user.split(','):
+        user_groups = (req.remote_user or '').split(',')
+        if '.reseller_admin' in user_groups:
+            return None
+        if account in user_groups and (req.method != 'PUT' or container):
+            # If the user is admin for the account and is not trying to do an
+            # account PUT...
             return None
         referrers, groups = parse_acl(getattr(req, 'acl', None))
         if referrer_allowed(req.referer, referrers):
             return None
         if not req.remote_user:
             return self.denied_response(req)
-        for user_group in req.remote_user.split(','):
+        for user_group in user_groups:
             if user_group in groups:
                 return None
         return self.denied_response(req)
 
=== modified file 'swift/proxy/server.py'
--- swift/proxy/server.py	2010-09-10 14:52:10 +0000
+++ swift/proxy/server.py	2010-09-12 00:25:58 +0000
@@ -35,13 +35,12 @@
 from swift.common.utils import get_logger, normalize_timestamp, split_path, \
     cache_from_env
 from swift.common.bufferedhttp import http_connect
-from swift.common.constraints import check_object_creation, check_metadata, \
-    MAX_FILE_SIZE, check_xml_encodable
+from swift.common.constraints import check_metadata, check_object_creation, \
+    check_xml_encodable, MAX_ACCOUNT_NAME_LENGTH, MAX_CONTAINER_NAME_LENGTH, \
+    MAX_FILE_SIZE
 from swift.common.exceptions import ChunkReadTimeout, \
     ChunkWriteTimeout, ConnectionTimeout
 
-MAX_CONTAINER_NAME_LENGTH = 256
-
 
 def update_headers(response, headers):
     """
@@ -1080,6 +1079,59 @@
                 req.path_info.rstrip('/'), self.app.account_ring.replica_count)
 
     @public
+    def PUT(self, req):
+        """HTTP PUT request handler."""
+        error_response = check_metadata(req, 'account')
+        if error_response:
+            return error_response
+        if len(self.account_name) > MAX_ACCOUNT_NAME_LENGTH:
+            resp = HTTPBadRequest(request=req)
+            resp.body = 'Account name length of %d longer than %d' % \
+                        (len(self.account_name), MAX_ACCOUNT_NAME_LENGTH)
+            return resp
+        account_partition, accounts = \
+            self.app.account_ring.get_nodes(self.account_name)
+        headers = {'X-Timestamp': normalize_timestamp(time.time()),
+                   'x-cf-trans-id': self.trans_id}
+        headers.update(value for value in req.headers.iteritems()
+            if value[0].lower().startswith('x-account-meta-'))
+        statuses = []
+        reasons = []
+        bodies = []
+        for node in self.iter_nodes(account_partition, accounts,
+                                    self.app.account_ring):
+            if self.error_limited(node):
+                continue
+            try:
+                with ConnectionTimeout(self.app.conn_timeout):
+                    conn = http_connect(node['ip'], node['port'],
+                            node['device'], account_partition, 'PUT',
+                            req.path_info, headers)
+                with Timeout(self.app.node_timeout):
+                    source = conn.getresponse()
+                    body = source.read()
+                    if 200 <= source.status < 300 \
+                            or 400 <= source.status < 500:
+                        statuses.append(source.status)
+                        reasons.append(source.reason)
+                        bodies.append(body)
+                    else:
+                        if source.status == 507:
+                            self.error_limit(node)
+            except:
+                self.exception_occurred(node, 'Account',
+                    'Trying to PUT to %s' % req.path)
+            if len(statuses) >= len(accounts):
+                break
+        while len(statuses) < len(accounts):
+            statuses.append(503)
+            reasons.append('')
+            bodies.append('')
+        self.app.memcache.delete('account%s' % req.path_info.rstrip('/'))
+        return self.best_response(req, statuses, reasons, bodies,
+                                  'Account PUT')
+
+    @public
     def POST(self, req):
         """HTTP POST request handler."""
         error_response = check_metadata(req, 'account')
 
=== modified file 'test/functional/swift.py'
--- test/functional/swift.py	2010-07-12 22:03:45 +0000
+++ test/functional/swift.py	2010-09-12 00:25:58 +0000
@@ -124,7 +124,7 @@
         if response.status == 401:
             raise AuthenticationFailed()
 
-        if response.status != 204:
+        if response.status not in (200, 204):
             raise ResponseError(response)
 
         for hdr in response.getheaders():
 
=== modified file 'test/functional/tests.py'
--- test/functional/tests.py	2010-09-03 04:50:16 +0000
+++ test/functional/tests.py	2010-09-12 00:25:58 +0000
@@ -172,7 +172,7 @@
 
     def testPUT(self):
         self.env.account.conn.make_request('PUT')
-        self.assert_status(405)
+        self.assert_status([403, 405])
 
     def testAccountHead(self):
         try_count = 0
 
=== modified file 'test/probe/common.py'
--- test/probe/common.py	2010-07-19 03:00:28 +0000
+++ test/probe/common.py	2010-09-12 00:25:58 +0000
@@ -13,16 +13,26 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from os import kill
+from os import environ, kill
 from signal import SIGTERM
 from subprocess import call, Popen
 from time import sleep
+from ConfigParser import ConfigParser
 
 from swift.common.bufferedhttp import http_connect_raw as http_connect
 from swift.common.client import get_auth
 from swift.common.ring import Ring
 
 
+AUTH_SERVER_CONF_FILE = environ.get('SWIFT_AUTH_SERVER_CONF_FILE',
+                                    '/etc/swift/auth-server.conf')
+c = ConfigParser()
+if not c.read(AUTH_SERVER_CONF_FILE):
+    exit('Unable to read config file: %s' % AUTH_SERVER_CONF_FILE)
+conf = dict(c.items('app:auth-server'))
+SUPER_ADMIN_KEY = conf.get('super_admin_key', 'devauth')
+
+
 def kill_pids(pids):
     for pid in pids.values():
         try:
@@ -50,7 +60,9 @@
         container_ring = Ring('/etc/swift/container.ring.gz')
         object_ring = Ring('/etc/swift/object.ring.gz')
         sleep(5)
-        conn = http_connect('127.0.0.1', '11000', 'POST', '/recreate_accounts')
+        conn = http_connect('127.0.0.1', '11000', 'POST', '/recreate_accounts',
+                headers={'X-Auth-Admin-User': '.super_admin',
+                         'X-Auth-Admin-Key': SUPER_ADMIN_KEY})
         resp = conn.getresponse()
         if resp.status != 200:
             raise Exception('Recreating accounts failed. (%d)' % resp.status)
 
=== modified file 'test/unit/auth/test_server.py'
--- test/unit/auth/test_server.py	2010-09-06 20:26:31 +0000
+++ test/unit/auth/test_server.py	2010-09-12 00:25:58 +0000
@@ -53,33 +53,27 @@
         def getheader(self, name):
             return self.getheaders().get(name.lower())
     code_iter = iter(code_iter)
-    def connect(*args, **ckwargs):
-        if 'give_content_type' in kwargs:
-            if len(args) >= 7 and 'content_type' in args[6]:
-                kwargs['give_content_type'](args[6]['content-type'])
-            else:
-                kwargs['give_content_type']('')
+    def connect(*args, **kwargs):
+        connect.last_args = args
+        connect.last_kwargs = kwargs
         return FakeConn(code_iter.next())
     return connect
 
 
-class FakeRing(object):
-    def get_nodes(self, path):
-        return 1, [{'ip': '10.0.0.%s' % x, 'port': 1000+x, 'device': 'sda'}
-                    for x in xrange(3)]
-
-
 class TestAuthServer(unittest.TestCase):
 
     def setUp(self):
+        self.ohttp_connect = auth_server.http_connect
         self.testdir = os.path.join(os.path.dirname(__file__),
                         'auth_server')
         rmtree(self.testdir, ignore_errors=1)
         os.mkdir(self.testdir)
-        self.conf = {'swift_dir': self.testdir, 'log_name': 'auth'}
-        self.controller = auth_server.AuthController(self.conf, FakeRing())
+        self.conf = {'swift_dir': self.testdir, 'log_name': 'auth',
+                     'super_admin_key': 'testkey'}
+        self.controller = auth_server.AuthController(self.conf)
 
     def tearDown(self):
+        auth_server.http_connect = self.ohttp_connect
         rmtree(self.testdir, ignore_errors=1)
 
     def test_get_conn(self):
@@ -106,7 +100,7 @@
             self.assert_(conn is not None)
 
     def test_validate_token_non_existant_token(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing',).split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/v1/test/auth',
@@ -117,7 +111,7 @@
         self.assertEquals(self.controller.validate_token(token + 'bad'), False)
 
     def test_validate_token_good(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing',).split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/v1/test/auth',
@@ -125,14 +119,14 @@
                 headers={'X-Storage-User': 'tester',
                          'X-Storage-Pass': 'testing'}))
         token = res.headers['x-storage-token']
-        ttl = self.controller.validate_token(token)
+        ttl, _, _, _ = self.controller.validate_token(token)
         self.assert_(ttl > 0, repr(ttl))
 
     def test_validate_token_expired(self):
         orig_time = auth_server.time
         try:
             auth_server.time = lambda: 1
-            auth_server.http_connect = fake_http_connect(201, 201, 201)
+            auth_server.http_connect = fake_http_connect(201)
             cfaccount = self.controller.create_user('test', 'tester',
                             'testing').split('/')[-1]
             res = self.controller.handle_auth(Request.blank('/v1/test/auth',
@@ -140,7 +134,7 @@
                     headers={'X-Storage-User': 'tester',
                              'X-Storage-Pass': 'testing'}))
             token = res.headers['x-storage-token']
-            ttl = self.controller.validate_token(token)
+            ttl, _, _, _ = self.controller.validate_token(token)
             self.assert_(ttl > 0, repr(ttl))
             auth_server.time = lambda: 1 + self.controller.token_life
             self.assertEquals(self.controller.validate_token(token), False)
@@ -148,107 +142,98 @@
             auth_server.time = orig_time
 
     def test_create_user_no_new_account(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         result = self.controller.create_user('', 'tester', 'testing')
         self.assertFalse(result)
 
     def test_create_user_no_new_user(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         result = self.controller.create_user('test', '', 'testing')
         self.assertFalse(result)
 
     def test_create_user_no_new_password(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         result = self.controller.create_user('test', 'tester', '')
         self.assertFalse(result)
 
     def test_create_user_good(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         url = self.controller.create_user('test', 'tester', 'testing')
         self.assert_(url)
         self.assertEquals('/'.join(url.split('/')[:-1]),
             self.controller.default_cluster_url.rstrip('/'), repr(url))
 
     def test_recreate_accounts_none(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         rv = self.controller.recreate_accounts()
         self.assertEquals(rv.split()[0], '0', repr(rv))
         self.assertEquals(rv.split()[-1], '[]', repr(rv))
 
     def test_recreate_accounts_one(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         self.controller.create_user('test', 'tester', 'testing')
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         rv = self.controller.recreate_accounts()
         self.assertEquals(rv.split()[0], '1', repr(rv))
         self.assertEquals(rv.split()[-1], '[]', repr(rv))
 
     def test_recreate_accounts_several(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         self.controller.create_user('test1', 'tester', 'testing')
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         self.controller.create_user('test2', 'tester', 'testing')
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         self.controller.create_user('test3', 'tester', 'testing')
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         self.controller.create_user('test4', 'tester', 'testing')
-        auth_server.http_connect = fake_http_connect(201, 201, 201,
-                                                     201, 201, 201,
-                                                     201, 201, 201,
-                                                     201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201, 201, 201, 201)
         rv = self.controller.recreate_accounts()
         self.assertEquals(rv.split()[0], '4', repr(rv))
         self.assertEquals(rv.split()[-1], '[]', repr(rv))
 
     def test_recreate_accounts_one_fail(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         url = self.controller.create_user('test', 'tester', 'testing')
         cfaccount = url.split('/')[-1]
-        auth_server.http_connect = fake_http_connect(500, 500, 500)
+        auth_server.http_connect = fake_http_connect(500)
         rv = self.controller.recreate_accounts()
         self.assertEquals(rv.split()[0], '1', repr(rv))
         self.assertEquals(rv.split()[-1], '[%s]' % repr(cfaccount),
                           repr(rv))
 
     def test_recreate_accounts_several_fail(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         url = self.controller.create_user('test1', 'tester', 'testing')
         cfaccounts = [url.split('/')[-1]]
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         url = self.controller.create_user('test2', 'tester', 'testing')
         cfaccounts.append(url.split('/')[-1])
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         url = self.controller.create_user('test3', 'tester', 'testing')
         cfaccounts.append(url.split('/')[-1])
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         url = self.controller.create_user('test4', 'tester', 'testing')
         cfaccounts.append(url.split('/')[-1])
-        auth_server.http_connect = fake_http_connect(500, 500, 500,
-                                                     500, 500, 500,
-                                                     500, 500, 500,
-                                                     500, 500, 500)
+        auth_server.http_connect = fake_http_connect(500, 500, 500, 500)
         rv = self.controller.recreate_accounts()
         self.assertEquals(rv.split()[0], '4', repr(rv))
         failed = rv.split('[', 1)[-1][:-1].split(', ')
         self.assertEquals(set(failed), set(repr(a) for a in cfaccounts))
 
     def test_recreate_accounts_several_fail_some(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         url = self.controller.create_user('test1', 'tester', 'testing')
         cfaccounts = [url.split('/')[-1]]
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         url = self.controller.create_user('test2', 'tester', 'testing')
         cfaccounts.append(url.split('/')[-1])
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         url = self.controller.create_user('test3', 'tester', 'testing')
         cfaccounts.append(url.split('/')[-1])
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         url = self.controller.create_user('test4', 'tester', 'testing')
         cfaccounts.append(url.split('/')[-1])
-        auth_server.http_connect = fake_http_connect(500, 500, 500,
-                                                     201, 201, 201,
-                                                     500, 500, 500,
-                                                     201, 201, 201)
+        auth_server.http_connect = fake_http_connect(500, 201, 500, 201)
         rv = self.controller.recreate_accounts()
         self.assertEquals(rv.split()[0], '4', repr(rv))
         failed = rv.split('[', 1)[-1][:-1].split(', ')
@@ -263,7 +248,7 @@
         self.assertEquals(res.status_int, 400)
 
     def test_auth_SOSO_missing_headers(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing').split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/v1/test/auth',
@@ -279,7 +264,7 @@
         self.assertEquals(res.status_int, 401)
 
     def test_auth_SOSO_bad_account(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing').split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/v1/testbad/auth',
@@ -294,7 +279,7 @@
         self.assertEquals(res.status_int, 401)
 
     def test_auth_SOSO_bad_user(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing').split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/v1/test/auth',
@@ -309,7 +294,7 @@
         self.assertEquals(res.status_int, 401)
 
     def test_auth_SOSO_bad_password(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing').split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/v1/test/auth',
@@ -324,7 +309,7 @@
         self.assertEquals(res.status_int, 401)
 
     def test_auth_SOSO_good(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing').split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/v1/test/auth',
@@ -332,11 +317,11 @@
                 headers={'X-Storage-User': 'tester',
                          'X-Storage-Pass': 'testing'}))
         token = res.headers['x-storage-token']
-        ttl = self.controller.validate_token(token)
+        ttl, _, _, _ = self.controller.validate_token(token)
         self.assert_(ttl > 0, repr(ttl))
 
     def test_auth_SOSO_good_Mosso_headers(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing').split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/v1/test/auth',
@@ -344,11 +329,11 @@
                 headers={'X-Auth-User': 'test:tester',
                          'X-Auth-Key': 'testing'}))
         token = res.headers['x-storage-token']
-        ttl = self.controller.validate_token(token)
+        ttl, _, _, _ = self.controller.validate_token(token)
         self.assert_(ttl > 0, repr(ttl))
 
     def test_auth_SOSO_bad_Mosso_headers(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing',).split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/v1/test/auth',
@@ -368,7 +353,7 @@
         self.assertEquals(res.status_int, 401)
 
     def test_auth_Mosso_missing_headers(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing').split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/auth',
@@ -384,7 +369,7 @@
         self.assertEquals(res.status_int, 401)
 
     def test_auth_Mosso_bad_header_format(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing').split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/auth',
@@ -399,7 +384,7 @@
         self.assertEquals(res.status_int, 401)
 
     def test_auth_Mosso_bad_account(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing').split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/auth',
@@ -414,7 +399,7 @@
         self.assertEquals(res.status_int, 401)
 
     def test_auth_Mosso_bad_user(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing').split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/auth',
@@ -429,7 +414,7 @@
         self.assertEquals(res.status_int, 401)
 
     def test_auth_Mosso_bad_password(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing').split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/auth',
@@ -444,7 +429,7 @@
         self.assertEquals(res.status_int, 401)
 
     def test_auth_Mosso_good(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing').split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/auth',
@@ -452,11 +437,11 @@
                 headers={'X-Auth-User': 'test:tester',
                          'X-Auth-Key': 'testing'}))
         token = res.headers['x-storage-token']
-        ttl = self.controller.validate_token(token)
+        ttl, _, _, _ = self.controller.validate_token(token)
         self.assert_(ttl > 0, repr(ttl))
 
     def test_auth_Mosso_good_SOSO_header_names(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         cfaccount = self.controller.create_user(
             'test', 'tester', 'testing').split('/')[-1]
         res = self.controller.handle_auth(Request.blank('/auth',
@@ -464,7 +449,7 @@
                 headers={'X-Storage-User': 'test:tester',
                          'X-Storage-Pass': 'testing'}))
         token = res.headers['x-storage-token']
-        ttl = self.controller.validate_token(token)
+        ttl, _, _, _ = self.controller.validate_token(token)
         self.assert_(ttl > 0, repr(ttl))
 
     def test_basic_logging(self):
@@ -473,11 +458,11 @@
         logger = get_logger(self.conf, 'auth')
         logger.logger.addHandler(log_handler)
         try:
-            auth_server.http_connect = fake_http_connect(201, 201, 201)
+            auth_server.http_connect = fake_http_connect(201)
             url = self.controller.create_user('test', 'tester', 'testing')
             self.assertEquals(log.getvalue().rsplit(' ', 1)[0],
-                "auth SUCCESS create_user('test', 'tester', _, False) = %s"
-                % repr(url))
+                "auth SUCCESS create_user('test', 'tester', _, False, False) "
+                "= %s" % repr(url))
             log.truncate(0)
             def start_response(*args):
                 pass
@@ -603,8 +588,8 @@
             conn.commit()
             conn.close()
             # Upgrade to current db
-            conf = {'swift_dir': swift_dir}
-            controller = auth_server.AuthController(conf, FakeRing())
+            conf = {'swift_dir': swift_dir, 'super_admin_key': 'testkey'}
+            controller = auth_server.AuthController(conf)
             # Check new items exist and are correct
             conn = get_db_connection(db_file)
             row = conn.execute('SELECT admin FROM account').fetchone()
@@ -614,21 +599,360 @@
         finally:
             rmtree(swift_dir)
 
+    def test_upgrading_from_db2(self):
+        swift_dir = '/tmp/swift_test_auth_%s' % uuid4().hex
+        os.mkdir(swift_dir)
+        try:
+            # Create db1
+            db_file = os.path.join(swift_dir, 'auth.db')
+            conn = get_db_connection(db_file, okay_to_create=True)
+            conn.execute('''CREATE TABLE IF NOT EXISTS account (
+                               account TEXT, url TEXT, cfaccount TEXT,
+                               user TEXT, password TEXT, admin TEXT)''')
+            conn.execute('''CREATE INDEX IF NOT EXISTS ix_account_account
+                            ON account (account)''')
+            conn.execute('''CREATE TABLE IF NOT EXISTS token (
+                               token TEXT, created FLOAT,
+                               account TEXT, user TEXT, cfaccount TEXT)''')
+            conn.execute('''CREATE INDEX IF NOT EXISTS ix_token_token
+                            ON token (token)''')
+            conn.execute('''CREATE INDEX IF NOT EXISTS ix_token_created
+                            ON token (created)''')
+            conn.execute('''CREATE INDEX IF NOT EXISTS ix_token_account
+                            ON token (account)''')
+            conn.execute('''INSERT INTO account
+                            (account, url, cfaccount, user, password, admin)
+                            VALUES ('act', 'url', 'cfa', 'us1', 'pas', '')''')
+            conn.execute('''INSERT INTO account
+                            (account, url, cfaccount, user, password, admin)
+                            VALUES ('act', 'url', 'cfa', 'us2', 'pas', 't')''')
+            conn.execute('''INSERT INTO token
+                            (token, created, account, user, cfaccount)
+                            VALUES ('tok', '1', 'act', 'us1', 'cfa')''')
+            conn.commit()
+            conn.close()
+            # Upgrade to current db
+            conf = {'swift_dir': swift_dir, 'super_admin_key': 'testkey'}
+            controller = auth_server.AuthController(conf)
+            # Check new items exist and are correct
+            conn = get_db_connection(db_file)
+            row = conn.execute('''SELECT admin, reseller_admin
+                                FROM account WHERE user = 'us1' ''').fetchone()
+            self.assert_(not row[0], row[0])
+            self.assert_(not row[1], row[1])
+            row = conn.execute('''SELECT admin, reseller_admin
+                                FROM account WHERE user = 'us2' ''').fetchone()
+            self.assertEquals(row[0], 't')
+            self.assert_(not row[1], row[1])
+            row = conn.execute('SELECT user FROM token').fetchone()
+            self.assert_(row)
+        finally:
+            rmtree(swift_dir)
+
     def test_create_user_twice(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         self.controller.create_user('test', 'tester', 'testing')
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         self.assertEquals(
             self.controller.create_user('test', 'tester', 'testing'),
             'already exists')
 
     def test_create_2users_1account(self):
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         url = self.controller.create_user('test', 'tester', 'testing')
-        auth_server.http_connect = fake_http_connect(201, 201, 201)
+        auth_server.http_connect = fake_http_connect(201)
         url2 = self.controller.create_user('test', 'tester2', 'testing2')
         self.assertEquals(url, url2)
 
+    def test_no_super_admin_key(self):
+        conf = {'swift_dir': self.testdir, 'log_name': 'auth'}
+        self.assertRaises(ValueError, auth_server.AuthController, conf)
+        conf['super_admin_key'] = 'testkey'
+        auth_server.AuthController(conf)
+
+    def test_add_storage_account(self):
+        auth_server.http_connect = fake_http_connect(201)
+        stgact = self.controller.add_storage_account()
+        self.assert_(stgact.startswith(self.controller.reseller_prefix),
+                     stgact)
+        # Make sure token given is the expected single use token
+        token = auth_server.http_connect.last_args[-1]['X-Auth-Token']
+        self.assert_(self.controller.validate_token(token))
+        self.assert_(not self.controller.validate_token(token))
+        auth_server.http_connect = fake_http_connect(201)
+        stgact = self.controller.add_storage_account('bob')
+        self.assertEquals(stgact, 'bob')
+        # Make sure token given is the expected single use token
+        token = auth_server.http_connect.last_args[-1]['X-Auth-Token']
+        self.assert_(self.controller.validate_token(token))
+        self.assert_(not self.controller.validate_token(token))
+
+    def test_regular_user(self):
+        auth_server.http_connect = fake_http_connect(201)
+        self.controller.create_user('act', 'usr', 'pas').split('/')[-1]
+        res = self.controller.handle_auth(Request.blank('/v1.0',
+                environ={'REQUEST_METHOD': 'GET'},
+                headers={'X-Auth-User': 'act:usr', 'X-Auth-Key': 'pas'}))
+        _, _, _, stgact = \
+            self.controller.validate_token(res.headers['x-auth-token'])
+        self.assertEquals(stgact, '')
+
+    def test_account_admin(self):
+        auth_server.http_connect = fake_http_connect(201)
+        stgact = self.controller.create_user(
+            'act', 'usr', 'pas', admin=True).split('/')[-1]
+        res = self.controller.handle_auth(Request.blank('/v1.0',
+                environ={'REQUEST_METHOD': 'GET'},
+                headers={'X-Auth-User': 'act:usr', 'X-Auth-Key': 'pas'}))
+        _, _, _, vstgact = \
+            self.controller.validate_token(res.headers['x-auth-token'])
+        self.assertEquals(stgact, vstgact)
+
+    def test_reseller_admin(self):
+        auth_server.http_connect = fake_http_connect(201)
+        self.controller.create_user(
+            'act', 'usr', 'pas', reseller_admin=True).split('/')[-1]
+        res = self.controller.handle_auth(Request.blank('/v1.0',
+                environ={'REQUEST_METHOD': 'GET'},
+                headers={'X-Auth-User': 'act:usr', 'X-Auth-Key': 'pas'}))
+        _, _, _, stgact = \
+            self.controller.validate_token(res.headers['x-auth-token'])
+        self.assertEquals(stgact, '.reseller_admin')
+
+    def test_is_account_admin(self):
+        req = Request.blank('/', headers={'X-Auth-Admin-User': '.super_admin',
+                                          'X-Auth-Admin-Key': 'testkey'})
+        self.assert_(self.controller.is_account_admin(req, 'any'))
+        req = Request.blank('/', headers={'X-Auth-Admin-User': '.super_admin',
+                                          'X-Auth-Admin-Key': 'testkey2'})
+        self.assert_(not self.controller.is_account_admin(req, 'any'))
+        req = Request.blank('/', headers={'X-Auth-Admin-User': '.super_admi',
+                                          'X-Auth-Admin-Key': 'testkey'})
+        self.assert_(not self.controller.is_account_admin(req, 'any'))
+
+        auth_server.http_connect = fake_http_connect(201, 201)
+        self.controller.create_user(
+            'act1', 'resadmin', 'pas', reseller_admin=True).split('/')[-1]
+        self.controller.create_user('act1', 'usr', 'pas').split('/')[-1]
+        self.controller.create_user(
+            'act2', 'actadmin', 'pas', admin=True).split('/')[-1]
+
+        req = Request.blank('/', headers={'X-Auth-Admin-User': 'act1:resadmin',
+                                          'X-Auth-Admin-Key': 'pas'})
+        self.assert_(self.controller.is_account_admin(req, 'any'))
+        self.assert_(self.controller.is_account_admin(req, 'act1'))
+        self.assert_(self.controller.is_account_admin(req, 'act2'))
+
+        req = Request.blank('/', headers={'X-Auth-Admin-User': 'act1:usr',
+                                          'X-Auth-Admin-Key': 'pas'})
+        self.assert_(not self.controller.is_account_admin(req, 'any'))
+        self.assert_(not self.controller.is_account_admin(req, 'act1'))
+        self.assert_(not self.controller.is_account_admin(req, 'act2'))
+
+        req = Request.blank('/', headers={'X-Auth-Admin-User': 'act2:actadmin',
+                                          'X-Auth-Admin-Key': 'pas'})
+        self.assert_(not self.controller.is_account_admin(req, 'any'))
+        self.assert_(not self.controller.is_account_admin(req, 'act1'))
+        self.assert_(self.controller.is_account_admin(req, 'act2'))
+
+    def test_handle_add_user_create_reseller_admin(self):
+        auth_server.http_connect = fake_http_connect(201)
+        self.controller.create_user('act', 'usr', 'pas')
+        self.controller.create_user('act', 'actadmin', 'pas', admin=True)
+        self.controller.create_user('act', 'resadmin', 'pas',
+                                    reseller_admin=True)
+
+        req = Request.blank('/account/act/resadmin2',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Reseller-Admin': 'true'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/account/act/resadmin2',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Reseller-Admin': 'true',
+                         'X-Auth-Admin-User': 'act:usr',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/account/act/resadmin2',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Reseller-Admin': 'true',
+                         'X-Auth-Admin-User': 'act:actadmin',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/account/act/resadmin2',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Reseller-Admin': 'true',
+                         'X-Auth-Admin-User': 'act:resadmin',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/account/act/resadmin2',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Reseller-Admin': 'true',
+                         'X-Auth-Admin-User': '.super_admin',
+                         'X-Auth-Admin-Key': 'testkey'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 2, resp.status_int)
+
+    def test_handle_add_user_create_account_admin(self):
+        auth_server.http_connect = fake_http_connect(201, 201)
+        self.controller.create_user('act', 'usr', 'pas')
+        self.controller.create_user('act', 'actadmin', 'pas', admin=True)
+        self.controller.create_user('act2', 'actadmin', 'pas', admin=True)
+        self.controller.create_user('act2', 'resadmin', 'pas',
+                                    reseller_admin=True)
+
+        req = Request.blank('/account/act/actadmin2',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/account/act/actadmin2',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': 'act:usr',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/account/act/actadmin2',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': 'act2:actadmin',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/account/act/actadmin2',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': 'act:actadmin',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 2, resp.status_int)
+
+        req = Request.blank('/account/act/actadmin3',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': 'act2:resadmin',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 2, resp.status_int)
+
+        req = Request.blank('/account/act/actadmin4',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': '.super_admin',
+                         'X-Auth-Admin-Key': 'testkey'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 2, resp.status_int)
+
+    def test_handle_add_user_create_normal_user(self):
+        auth_server.http_connect = fake_http_connect(201, 201)
+        self.controller.create_user('act', 'usr', 'pas')
+        self.controller.create_user('act', 'actadmin', 'pas', admin=True)
+        self.controller.create_user('act2', 'actadmin', 'pas', admin=True)
+        self.controller.create_user('act2', 'resadmin', 'pas',
+                                    reseller_admin=True)
+
+        req = Request.blank('/account/act/usr2',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/account/act/usr2',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': 'act:usr',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/account/act/usr2',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': 'act2:actadmin',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/account/act/usr2',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': 'act:actadmin',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 2, resp.status_int)
+
+        req = Request.blank('/account/act/usr3',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': 'act2:resadmin',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 2, resp.status_int)
+
+        req = Request.blank('/account/act/usr4',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': '.super_admin',
+                         'X-Auth-Admin-Key': 'testkey'})
+        resp = self.controller.handle_add_user(req)
+        self.assert_(resp.status_int // 100 == 2, resp.status_int)
+
+    def test_handle_account_recreate_permissions(self):
+        auth_server.http_connect = fake_http_connect(201, 201)
+        self.controller.create_user('act', 'usr', 'pas')
+        self.controller.create_user('act', 'actadmin', 'pas', admin=True)
+        self.controller.create_user('act', 'resadmin', 'pas',
+                                    reseller_admin=True)
+
+        req = Request.blank('/recreate_accounts',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true'})
+        resp = self.controller.handle_account_recreate(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/recreate_accounts',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': 'act:usr',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_account_recreate(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/recreate_accounts',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': 'act:actadmin',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_account_recreate(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/recreate_accounts',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': 'act:resadmin',
+                         'X-Auth-Admin-Key': 'pas'})
+        resp = self.controller.handle_account_recreate(req)
+        self.assert_(resp.status_int // 100 == 4, resp.status_int)
+
+        req = Request.blank('/recreate_accounts',
+                headers={'X-Auth-User-Key': 'pas',
+                         'X-Auth-User-Admin': 'true',
+                         'X-Auth-Admin-User': '.super_admin',
+                         'X-Auth-Admin-Key': 'testkey'})
+        resp = self.controller.handle_account_recreate(req)
+        self.assert_(resp.status_int // 100 == 2, resp.status_int)
+
 
 if __name__ == '__main__':
     unittest.main()
 
=== modified file 'test/unit/common/middleware/test_auth.py'
--- test/unit/common/middleware/test_auth.py	2010-09-09 17:24:25 +0000
+++ test/unit/common/middleware/test_auth.py	2010-09-12 00:25:58 +0000
@@ -289,6 +289,37 @@
         req.acl = '.r:.example.com'
         self.assertEquals(self.test_auth.authorize(req), None)
 
+    def test_account_put_permissions(self):
+        req = Request.blank('/v1/AUTH_new', environ={'REQUEST_METHOD': 'PUT'})
+        req.remote_user = 'act:usr,act'
+        resp = str(self.test_auth.authorize(req))
+        self.assert_(resp.startswith('403'), resp)
+
+        req = Request.blank('/v1/AUTH_new', environ={'REQUEST_METHOD': 'PUT'})
+        req.remote_user = 'act:usr,act,AUTH_other'
+        resp = str(self.test_auth.authorize(req))
+        self.assert_(resp.startswith('403'), resp)
+
+        # Even PUTs to your own account as account admin should fail
+        req = Request.blank('/v1/AUTH_old', environ={'REQUEST_METHOD': 'PUT'})
+        req.remote_user = 'act:usr,act,AUTH_old'
+        resp = str(self.test_auth.authorize(req))
+        self.assert_(resp.startswith('403'), resp)
+
+        req = Request.blank('/v1/AUTH_new', environ={'REQUEST_METHOD': 'PUT'})
+        req.remote_user = 'act:usr,act,.reseller_admin'
+        resp = self.test_auth.authorize(req)
+        self.assertEquals(resp, None)
+
+        # .super_admin is not something the middleware should ever see or care
+        # about
+        req = Request.blank('/v1/AUTH_new', environ={'REQUEST_METHOD': 'PUT'})
+        req.remote_user = 'act:usr,act,.super_admin'
+        resp = self.test_auth.authorize(req)
+        resp = str(self.test_auth.authorize(req))
+        self.assert_(resp.startswith('403'), resp)
+
+
 
 if __name__ == '__main__':
     unittest.main()
 
=== modified file 'test/unit/proxy/test_server.py'
--- test/unit/proxy/test_server.py	2010-09-09 05:37:27 +0000
+++ test/unit/proxy/test_server.py	2010-09-12 00:25:58 +0000
@@ -2153,90 +2153,136 @@
             finally: 
                 self.app.object_chunk_size = orig_object_chunk_size
 
+    def test_PUT(self):
+        with save_globals():
+            controller = proxy_server.AccountController(self.app, 'account')
+            def test_status_map(statuses, expected, **kwargs):
+                proxy_server.http_connect = \
+                    fake_http_connect(*statuses, **kwargs)
+                self.app.memcache.store = {}
+                req = Request.blank('/a', {})
+                req.content_length = 0
+                self.app.update_request(req)
+                res = controller.PUT(req)
+                expected = str(expected)
+                self.assertEquals(res.status[:len(expected)], expected)
+            test_status_map((201, 201, 201), 201)
+            test_status_map((201, 201, 500), 201)
+            test_status_map((201, 500, 500), 503)
+            test_status_map((204, 500, 404), 503)
+
+    def test_PUT_max_account_name_length(self):
+        with save_globals():
+            controller = proxy_server.AccountController(self.app, '1'*256)
+            self.assert_status_map(controller.PUT, (201, 201, 201), 201)
+            controller = proxy_server.AccountController(self.app, '2'*257)
+            self.assert_status_map(controller.PUT, (201, 201, 201), 400)
+
+    def test_PUT_connect_exceptions(self):
+        with save_globals():
+            controller = proxy_server.AccountController(self.app, 'account')
+            self.assert_status_map(controller.PUT, (201, 201, -1), 201)
+            self.assert_status_map(controller.PUT, (201, -1, -1), 503)
+            self.assert_status_map(controller.PUT, (503, 503, -1), 503)
+
+    def test_PUT_metadata(self):
+        self.metadata_helper('PUT')
+
     def test_POST_metadata(self):
+        self.metadata_helper('POST')
+
+    def metadata_helper(self, method):
         for test_header, test_value in (
                 ('X-Account-Meta-TestHeader', 'TestValue'),
                 ('X-Account-Meta-TestHeader', '')):
             test_errors = []
             def test_connect(ipaddr, port, device, partition, method, path,
                              headers=None, query_string=None):
-                for k, v in headers.iteritems():
-                    if k.lower() == test_header.lower() and \
-                            v == test_value:
-                        break
-                else:
-                    test_errors.append('%s: %s not in %s' %
-                                       (test_header, test_value, headers))
+                if path == '/a':
+                    for k, v in headers.iteritems():
+                        if k.lower() == test_header.lower() and \
+                                v == test_value:
+                            break
+                    else:
+                        test_errors.append('%s: %s not in %s' %
+                                           (test_header, test_value, headers))
             with save_globals():
                 controller = \
                     proxy_server.AccountController(self.app, 'a')
                 proxy_server.http_connect = fake_http_connect(201, 201, 201,
-                    give_connect=test_connect)
-                req = Request.blank('/a', environ={'REQUEST_METHOD': 'POST'},
+                                                give_connect=test_connect)
+                req = Request.blank('/a/c', environ={'REQUEST_METHOD': method},
                         headers={test_header: test_value})
                 self.app.update_request(req)
-                res = controller.POST(req)
+                res = getattr(controller, method)(req)
                 self.assertEquals(test_errors, [])
 
+
+    def test_PUT_bad_metadata(self):
+        self.bad_metadata_helper('PUT')
+
     def test_POST_bad_metadata(self):
+        self.bad_metadata_helper('POST')
+
+    def bad_metadata_helper(self, method):
         with save_globals():
             controller = proxy_server.AccountController(self.app, 'a')
-            proxy_server.http_connect = fake_http_connect(204, 204, 204)
-            req = Request.blank('/a', environ={'REQUEST_METHOD': 'POST'})
+            proxy_server.http_connect = fake_http_connect(200, 201, 201, 201)
+            req = Request.blank('/a/c', environ={'REQUEST_METHOD': method})
             self.app.update_request(req)
-            resp = controller.POST(req)
-            self.assertEquals(resp.status_int, 204)
+            resp = getattr(controller, method)(req)
+            self.assertEquals(resp.status_int, 201)
 
-            proxy_server.http_connect = fake_http_connect(204, 204, 204)
-            req = Request.blank('/a', environ={'REQUEST_METHOD': 'POST'},
+            proxy_server.http_connect = fake_http_connect(201, 201, 201)
+            req = Request.blank('/a/c', environ={'REQUEST_METHOD': method},
                     headers={'X-Account-Meta-' +
                                 ('a' * MAX_META_NAME_LENGTH): 'v'})
             self.app.update_request(req)
-            resp = controller.POST(req)
-            self.assertEquals(resp.status_int, 204)
-            proxy_server.http_connect = fake_http_connect(204, 204, 204)
-            req = Request.blank('/a', environ={'REQUEST_METHOD': 'POST'},
+            resp = getattr(controller, method)(req)
+            self.assertEquals(resp.status_int, 201)
+            proxy_server.http_connect = fake_http_connect(201, 201, 201)
+            req = Request.blank('/a/c', environ={'REQUEST_METHOD': method},
                     headers={'X-Account-Meta-' +
                                 ('a' * (MAX_META_NAME_LENGTH + 1)): 'v'})
             self.app.update_request(req)
-            resp = controller.POST(req)
+            resp = getattr(controller, method)(req)
             self.assertEquals(resp.status_int, 400)
 
-            proxy_server.http_connect = fake_http_connect(204, 204, 204)
-            req = Request.blank('/a', environ={'REQUEST_METHOD': 'POST'},
+            proxy_server.http_connect = fake_http_connect(201, 201, 201)
+            req = Request.blank('/a/c', environ={'REQUEST_METHOD': method},
                     headers={'X-Account-Meta-Too-Long':
                                 'a' * MAX_META_VALUE_LENGTH})
             self.app.update_request(req)
-            resp = controller.POST(req)
-            self.assertEquals(resp.status_int, 204)
-            proxy_server.http_connect = fake_http_connect(204, 204, 204)
-            req = Request.blank('/a', environ={'REQUEST_METHOD': 'POST'},
+            resp = getattr(controller, method)(req)
+            self.assertEquals(resp.status_int, 201)
+            proxy_server.http_connect = fake_http_connect(201, 201, 201)
+            req = Request.blank('/a/c', environ={'REQUEST_METHOD': method},
                     headers={'X-Account-Meta-Too-Long':
                                 'a' * (MAX_META_VALUE_LENGTH + 1)})
             self.app.update_request(req)
-            resp = controller.POST(req)
+            resp = getattr(controller, method)(req)
             self.assertEquals(resp.status_int, 400)
 
-            proxy_server.http_connect = fake_http_connect(204, 204, 204)
+            proxy_server.http_connect = fake_http_connect(201, 201, 201)
             headers = {}
             for x in xrange(MAX_META_COUNT):
                 headers['X-Account-Meta-%d' % x] = 'v'
-            req = Request.blank('/a', environ={'REQUEST_METHOD': 'POST'},
+            req = Request.blank('/a/c', environ={'REQUEST_METHOD': method},
                                 headers=headers)
             self.app.update_request(req)
-            resp = controller.POST(req)
-            self.assertEquals(resp.status_int, 204)
-            proxy_server.http_connect = fake_http_connect(204, 204, 204)
+            resp = getattr(controller, method)(req)
+            self.assertEquals(resp.status_int, 201)
+            proxy_server.http_connect = fake_http_connect(201, 201, 201)
             headers = {}
             for x in xrange(MAX_META_COUNT + 1):
                 headers['X-Account-Meta-%d' % x] = 'v'
-            req = Request.blank('/a', environ={'REQUEST_METHOD': 'POST'},
+            req = Request.blank('/a/c', environ={'REQUEST_METHOD': method},
                                 headers=headers)
             self.app.update_request(req)
-            resp = controller.POST(req)
+            resp = getattr(controller, method)(req)
             self.assertEquals(resp.status_int, 400)
 
-            proxy_server.http_connect = fake_http_connect(204, 204, 204)
+            proxy_server.http_connect = fake_http_connect(201, 201, 201)
             headers = {}
             header_value = 'a' * MAX_META_VALUE_LENGTH
             size = 0
@@ -2248,18 +2294,18 @@
             if MAX_META_OVERALL_SIZE - size > 1:
                 headers['X-Account-Meta-a'] = \
                     'a' * (MAX_META_OVERALL_SIZE - size - 1)
-            req = Request.blank('/a', environ={'REQUEST_METHOD': 'POST'},
+            req = Request.blank('/a/c', environ={'REQUEST_METHOD': method},
                                 headers=headers)
             self.app.update_request(req)
-            resp = controller.POST(req)
-            self.assertEquals(resp.status_int, 204)
-            proxy_server.http_connect = fake_http_connect(204, 204, 204)
+            resp = getattr(controller, method)(req)
+            self.assertEquals(resp.status_int, 201)
+            proxy_server.http_connect = fake_http_connect(201, 201, 201)
             headers['X-Account-Meta-a'] = \
                 'a' * (MAX_META_OVERALL_SIZE - size)
-            req = Request.blank('/a', environ={'REQUEST_METHOD': 'POST'},
+            req = Request.blank('/a/c', environ={'REQUEST_METHOD': method},
                                 headers=headers)
             self.app.update_request(req)
-            resp = controller.POST(req)
+            resp = getattr(controller, method)(req)
             self.assertEquals(resp.status_int, 400)