Fix authorization stack to call all modules

All authorization modules need to be executed, we cannot bail at the
first one that returns a positive answer. Some authz modules attach
data to the requst as a side effect and they need to be run even if
others also authorize access.
Additionally if a later module returns an explicit Deny, then that
must override any previous granted access.

Signed-off-by: Simo Sorce <simo@redhat.com>

1 files changed, 6 insertions, 2 deletions

diff --git a/custodia/httpd/server.py b/custodia/httpd/server.py
index 2d6de41..decf401 100644
--- a/custodia/httpd/server.py
+++ b/custodia/httpd/server.py
@@ -337,11 +337,15 @@ class HTTPRequestHandler(BaseHTTPRequestHandler):
         authzers = config.get('authorizers')
         if authzers is None:
             raise HTTPError(403)
+        authz_ok = None
         for authz in authzers:
             valid = authzers[authz].handle(request)
-            if valid is not None:
+            if valid is True:
+                authz_ok = True
+            elif valid is False:
+                authz_ok = False
                 break
-        if valid is not True:
+        if authz_ok is not True:
             self.server.auditlog.svc_access(self.__class__.__name__,
                                             log.AUDIT_SVC_AUTHZ_FAIL,
                                             request['client_id'],