D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
usr
/
lib
/
python3.9
/
site-packages
/
ipalib
/
__pycache__
/
Filename :
kinit.cpython-39.pyc
back
Copy
a }�f� � @ s� d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ d dl m Z d dl m Z d dl mZ d dlmZ e �e�ZdZd e dd � d e Zd e Ze�e�Ze�e�Zd d� Zddd�Zd dd�Z d dd�Z d dd�Z d dd�Z dS ) � N)� Principal)�paths)�run)�PATTERN_GROUPUSER_NAME)� krb_utils)�validate_hostnamez@?([a-zA-Z0-9.-]*)$�(����)z!([a-zA-Z0-9.-]+)/([a-zA-Z0-9.-]+)c C s� t | t�rt| �} nt | t�s&td��d| v r@d| v r@td��ntt�| �}|d u r�t�| �}|d u rntd��nF|d }z t|� W n0 ty� } ztt|���W Y d }~n d }~0 0 | S )Nz Invalid principal: not a string�/� z Invalid principal: bad spacingz Invalid principal: cannot parse� ) � isinstancer �str� RuntimeError� user_pattern�match�service_patternr � ValueError)� principalr �hostname�e� r �0/usr/lib/python3.9/site-packages/ipalib/kinit.py�validate_principal s" "r � c C s� t | � tjtjh}t�d| |� d|i}|durFt�d|� ||d< td|d �D �]^}tj� d�}|durz|tjd< ntj� dd� � z�z`t � t | �t jj�} t j| |dd �} t�d ||� | W W |dur�|tjd< ntj� dd� S t jj�y` } zV| j|v�r� t�d ||| � ||k�r8t�d |� � t�d � t�d� W Y d} ~ n d} ~ 0 0 W |du�rz|tjd< ntj� dd� n&|du�r�|tjd< ntj� dd� 0 dS dS )z� Given a ccache_path, keytab file and a principal kinit as that user. The optional parameter 'attempts' specifies how many times the credential initialization should be attempted in case of non-responsive KDC. z)Initializing principal %s using keytab %sZ client_keytabNzusing ccache %sZccacher � KRB5_CONFIGZinitiate)�name�store�usagezAttempt %d/%d: successzAttempt %d/%d: failed: %sz'Maximum number of attempts (%d) reachedz#Waiting 5 seconds before next retry� )r r ZKRB5KDC_ERR_SVC_UNAVAILABLEZKRB5_KDC_UNREACH�logger�debug�range�os�environ�get�pop�gssapi�Namer ZNameTypeZkerberos_principalZ Credentials� exceptionsZGSSErrorZmin_code�time�sleep) r Zkeytab� ccache_name�configZattemptsZerrors_to_retryr ZattemptZ old_configr Zcredr r r r � kinit_keytab8 sX �� � � � " � r/ c C sB ddi}t j�� D ]\}}|�d�r|||< q| dur>| |d< |S )zPCommon os.environ for kinit Passes KRB5* and GSS* envs like KRB5_TRACE �LC_ALL�C)ZKRB5ZGSSNr )r$ r% �items� startswith)r. �env�key�valuer r r �_run_envi s r7 Fc C s� t | � t�d| � tjg}|dur2|�d|g� |durTt�d|� |�d|g� |rf|�d|g� |r~t�d� |�d� |r�t�d � |�d � |�d t| �g� t|�} t ||| d d d�} | j r�t | j ��| S )aY perform interactive kinit as principal using password. If using FAST for web-based authentication, use armor_ccache_path to specify http service ccache. :param principal: principal name :param password: user password :param ccache_name: location of ccache (default: default location) :param config: path to krb5.conf (default: default location) :param armor_ccache_name: armor ccache for FAST (-T) :param canonicalize: request principal canonicalization (-C) :param enterprise: use enterprise principal (-E) :param lifetime: request TGT lifetime (-l) z(Initializing principal %s using passwordN�-cz&Using armor ccache %s for FAST webauthz-Tz-lz%Requesting principal canonicalizationz-CzUsing enterprise principalz-E�--FT)�stdinr4 � raiseonerr� capture_error) r r! r" r �KINIT�extend�appendr r7 r � returncoder Z error_output) r �passwordr- r. Zarmor_ccache_nameZ canonicalizeZ enterpriseZlifetime�argsr4 �resultr r r �kinit_passwordw s4 � � rD c C sT t �d� t� }tjdd| g}|durD|D ]}|�dd�|�g� q*t||ddd�S ) a� perform anonymous pkinit to obtain anonymous ticket to be used as armor for FAST. :param ccache_name: location of the armor ccache (required) :param pkinit_anchor: if not None, the location of PKINIT anchor file to use. Otherwise the value from Kerberos client library configuration is used :raises: CalledProcessError if the anonymous PKINIT fails z Initializing anonymous ccachez-nr8 N�-XzX509_anchors=FILE:{}T)r4 r; r< )r! r" r7 r r= r> �formatr )r- �pkinit_anchorsr4 rB � pkinit_anchorr r r � kinit_armor� s rI c C s� t | � t�d| |� tjg}|dur4|�d|g� |durh|D ]&}|�d�sRJ �|�dd|� �g� q@|�dd|� �g� |�dt| �g� t|�}t ||d d d d �S ) a� Perform kinit with X.509 identity (PKINIT) :param principal: principal name :param user_identity: X509_user_identity paramemter :param ccache_name: location of ccache (default: default location) :param config: path to krb5.conf (default: default location) :param pkinit_anchor: if not None, the PKINIT anchors to use. Otherwise the value from Kerberos client library configuration is used. Entries must be prefixed with FILE: or DIR: user identity example: FILE:filename[,keyfilename] PKCS12:filename PKCS11:... DIR:directoryname :raises: CalledProcessError if PKINIT fails z)Initializing principal %s using PKINIT %sNr8 )zFILE:zDIR:zENV:rE z X509_anchors=zX509_user_identity=r9 � T)r4 r: r; r< ) r r! r" r r= r> r3 r r7 r )r Z user_identityr- r. rG rB rH r4 r r r � kinit_pkinit� s �rK )NNr )N)NNNFFN)N)NNN) Zloggingr$ �rer+ r( Zipapython.kerberosr Zipaplatform.pathsr Zipapython.ipautilr Zipalib.constantsr Zipalibr Z ipalib.utilr Z getLogger�__name__r! Z PATTERN_REALMZPATTERN_PRINCIPALZPATTERN_SERVICE�compiler r r r/ r7 rD rI rK r r r r �<module> s8 1 � 2 �