Python client.SASLClient类代码示例

    def authenticate_xmpp(self):
        """Authenticate the user to the XMPP server via the BOSH connection."""

        self.request_sid()

        self.log.debug('Prepare the XMPP authentication')

        # Instantiate a sasl object
        sasl = SASLClient(
            host=self.to,
            service='xmpp',
            username=self.jid,
            password=self.password
        )

        # Choose an auth mechanism
        sasl.choose_mechanism(self.server_auth, allow_anonymous=False)

        # Request challenge
        challenge = self.get_challenge(sasl.mechanism)

        # Process challenge and generate response
        response = sasl.process(base64.b64decode(challenge))

        # Send response
        resp_root = self.send_challenge_response(response)

        success = self.check_authenticate_success(resp_root)
        if success is None and\
                resp_root.find('{{{0}}}challenge'.format(XMPP_SASL_NS)) is not None:
            resp_root = self.send_challenge_response('')
            return self.check_authenticate_success(resp_root)
        return success

    def authenticate_xmpp(self):
        """Authenticate the user to the XMPP server via the BOSH connection."""

        self.request_sid()

        self.log.debug('Prepare the XMPP authentication')

        # Instantiate a sasl object 
        sasl = SASLClient(host=self.to,
                         service='xmpp',
                         username=self.jid,
                         password=self.password)

        # Choose an auth mechanism
        sasl.choose_mechanism(self.server_auth, allow_anonymous=False)

        # Request challenge
        challenge = self.get_challenge(sasl.mechanism)
        
        # Process challenge and generate response
        response = sasl.process(base64.b64decode(challenge))

        # Send response
        success = self.send_challenge_response(response)
        if not success:
            return False

        self.request_restart()

        self.bind_resource()
        
        return True

def sasl_bind(client, host):
    sasl_client = SASLClient(host, service='ldap', mechanism='GSSAPI')
    
    sasl_credentials = SaslCredentials()
    sasl_credentials.setComponentByName("mechanism", LDAPString("gssapi"))
    sasl_credentials.setComponentByName("credentials", sasl_client.process(None))

    authentication_choice = AuthenticationChoice()
    authentication_choice.setComponentByName('sasl', sasl_credentials)
    
    bind_request = BindRequest()
    bind_request.setComponentByName('version', Version(3))
    bind_request.setComponentByName('name', LDAPDN(''))
    bind_request.setComponentByName('authentication', authentication_choice)
    
    protocol_op = ProtocolOp()
    protocol_op.setComponentByName("bindRequest", bind_request)
    
    ber_encode(authentication_choice)
    ber_encode(sasl_credentials)
    print(bind_request.prettyPrint())
    ber_encode(bind_request)
    ber_encode(protocol_op)
    response = yield from client.request(protocol_op)
    
    print(response)

class GSSAPIAuthenticator(BaseDSEAuthenticator):
    def __init__(self, host, service, qops, properties):
        properties = properties or {}
        self.sasl = SASLClient(host, service, 'GSSAPI', qops=qops, **properties)

    def get_mechanism(self):
        return "GSSAPI"

    def get_initial_challenge(self):
        return "GSSAPI-START"

    def evaluate_challenge(self, challenge):
        if challenge == 'GSSAPI-START':
            return self.sasl.process()
        else:
            return self.sasl.process(challenge)

class SaslAuthenticator(Authenticator):
    """
    An :class:`~.Authenticator` that works with DSE's KerberosAuthenticator.

    .. versionadded:: 2.1.3-post
    """

    def __init__(self, host, service, mechanism='GSSAPI', **sasl_kwargs):
        if SASLClient is None:
            raise ImportError('The puresasl library has not been installed')
        self.sasl = SASLClient(host, service, mechanism, **sasl_kwargs)

    def initial_response(self):
        return self.sasl.process()

    def evaluate_challenge(self, challenge):
        return self.sasl.process(challenge)

class SaslAuthenticator(Authenticator):
    """
    A pass-through :class:`~.Authenticator` using the third party package
    'pure-sasl' for authentication

    .. versionadded:: 2.1.4
    """

    def __init__(self, host, service, mechanism='GSSAPI', **sasl_kwargs):
        if SASLClient is None:
            raise ImportError('The puresasl library has not been installed')
        self.sasl = SASLClient(host, service, mechanism, **sasl_kwargs)

    def initial_response(self):
        return self.sasl.process()

    def evaluate_challenge(self, challenge):
        return self.sasl.process(challenge)

    def __init__(self, transport, host, service,
            mechanism='GSSAPI', **sasl_kwargs):

        from puresasl.client import SASLClient

        self.transport = transport
        self.sasl = SASLClient(host, service, mechanism, **sasl_kwargs)

        self.__wbuf = StringIO()
        self.__rbuf = StringIO()

 def __init__(self, transport, host, service, mechanism="GSSAPI", **sasl_kwargs):
     """
     transport: an underlying transport to use, typically just a TSocket
     host: the name of the server, from a SASL perspective
     service: the name of the server's service, from a SASL perspective
     mechanism: the name of the preferred mechanism to use
     All other kwargs will be passed to the puresasl.client.SASLClient
     constructor.
     """
     self.transport = transport
     self.sasl = SASLClient(host, service, mechanism, **sasl_kwargs)
     self.__wbuf = StringIO()
     self.__rbuf = StringIO()

class TSaslClientTransport(TTransportBase, CReadableTransport):
    """
    A SASL transport based on the pure-sasl library:
        https://github.com/thobbs/pure-sasl
    """

    START = 1
    OK = 2
    BAD = 3
    ERROR = 4
    COMPLETE = 5

    def __init__(self, transport, host, service, mechanism="GSSAPI", **sasl_kwargs):
        """
        transport: an underlying transport to use, typically just a TSocket
        host: the name of the server, from a SASL perspective
        service: the name of the server's service, from a SASL perspective
        mechanism: the name of the preferred mechanism to use
        All other kwargs will be passed to the puresasl.client.SASLClient
        constructor.
        """
        self.transport = transport
        self.sasl = SASLClient(host, service, mechanism, **sasl_kwargs)
        self.__wbuf = StringIO()
        self.__rbuf = StringIO()

        # extremely awful hack, but you've got to do what you've got to do.
        # essentially "wrap" and "unwrap" are defined for the base Mechanism class and raise a NotImplementedError by
        # default, and PlainMechanism doesn't implement its own versions (lol).

    #        self.sasl._chosen_mech.wrap = lambda x: x
    #        self.sasl._chosen_mech.unwrap = lambda x: x

    def open(self):
        if not self.transport.isOpen():
            self.transport.open()

        self.send_sasl_msg(self.START, self.sasl.mechanism)
        self.send_sasl_msg(self.OK, self.sasl.process() or "")

        while True:
            status, challenge = self.recv_sasl_msg()
            if status == self.OK:
                self.send_sasl_msg(self.OK, self.sasl.process(challenge) or "")
            elif status == self.COMPLETE:
                # self.sasl.complete is not set for PLAIN authentication (trollface.jpg) so we have to skip this check
                #                break
                if not self.sasl.complete:
                    raise TTransportException("The server erroneously indicated " "that SASL negotiation was complete")
                else:
                    break
            else:
                raise TTransportException("Bad SASL negotiation status: %d (%s)" % (status, challenge))

    def send_sasl_msg(self, status, body):
        if body is None:
            body = ""
        header = pack(">BI", status, len(body))

        body = body if isinstance(body, bytes) else body.encode("utf-8")

        self.transport.write(header + body)
        self.transport.flush()

    def recv_sasl_msg(self):
        header = self.transport.readAll(5)
        status, length = unpack(">BI", header)
        if length > 0:
            payload = self.transport.readAll(length)
        else:
            payload = ""
        return status, payload

    def write(self, data):
        self.__wbuf.write(data)

    def flush(self):
        data = self.__wbuf.getvalue()
        encoded = self.sasl.wrap(data)
        self.transport.write("".join((pack("!i", len(encoded)), encoded)))
        self.transport.flush()
        self.__wbuf = StringIO()

    def read(self, sz):
        ret = self.__rbuf.read(sz)
        if len(ret) != 0:
            return ret

        self._read_frame()
        return self.__rbuf.read(sz)

    def _read_frame(self):
        header = self.transport.readAll(4)
        length, = unpack("!i", header)
        encoded = self.transport.readAll(length)
        self.__rbuf = StringIO(self.sasl.unwrap(encoded))

    def close(self):
        self.sasl.dispose()
        self.transport.close()
#.........这里部分代码省略.........

 def __init__(self, *args, **kwds):
     SASLClient.__init__(self, 'testhost')

    def negotiate_sasl(self, token):
        log.debug("##############NEGOTIATING SASL#####################")

        # Prepares negotiate request

        header_bytes = self.create_sasl_header().SerializeToString()

        negotiate_request = RpcSaslProto()
        negotiate_request.state = RpcSaslProto.NEGOTIATE
        negotiate_request.version = 0

        sasl_bytes = negotiate_request.SerializeToString()

        total_length = (
            len(header_bytes)
            + len(sasl_bytes)
            + encoder._VarintSize(len(header_bytes))
            + encoder._VarintSize(len(sasl_bytes))
        )

        # Sends negotiate request
        self.write(struct.pack("!I", total_length))
        self.write_delimited(header_bytes)
        self.write_delimited(sasl_bytes)

        # Gets negotiate response
        bytes = self.recv_rpc_message()
        resp = self.parse_response(bytes, RpcSaslProto)

        chosen_auth = None
        for auth in resp.auths:
            if auth.method == "TOKEN" and auth.mechanism == "DIGEST-MD5":
                chosen_auth = auth

        if chosen_auth is None:
            raise IOError("Token digest-MD5 authentication not supported by server")

        # Prepares initiate request

        self.sasl = SASLClient(
            chosen_auth.serverId,
            chosen_auth.protocol,
            mechanism=chosen_auth.mechanism,
            username=base64.b64encode(token["identifier"]),
            password=base64.b64encode(token["password"]),
        )

        challenge_resp = self.sasl.process(chosen_auth.challenge)

        auth = RpcSaslProto.SaslAuth()
        auth.method = chosen_auth.method
        auth.mechanism = chosen_auth.mechanism
        auth.protocol = chosen_auth.protocol
        auth.serverId = chosen_auth.serverId

        initiate_request = RpcSaslProto()
        initiate_request.state = RpcSaslProto.INITIATE
        initiate_request.version = 0
        initiate_request.auths.extend([auth])
        initiate_request.token = challenge_resp

        sasl_bytes = initiate_request.SerializeToString()

        total_length = (
            len(header_bytes)
            + len(sasl_bytes)
            + encoder._VarintSize(len(header_bytes))
            + encoder._VarintSize(len(sasl_bytes))
        )

        # Sends initiate request
        self.write(struct.pack("!I", total_length))
        self.write_delimited(header_bytes)
        self.write_delimited(sasl_bytes)

        bytes = self.recv_rpc_message()
        resp = self.parse_response(bytes, RpcSaslProto)

#.........这里部分代码省略.........

        negotiate_request = RpcSaslProto()
        negotiate_request.state = RpcSaslProto.NEGOTIATE
        negotiate_request.version = 0

        sasl_bytes = negotiate_request.SerializeToString()

        total_length = (
            len(header_bytes)
            + len(sasl_bytes)
            + encoder._VarintSize(len(header_bytes))
            + encoder._VarintSize(len(sasl_bytes))
        )

        # Sends negotiate request
        self.write(struct.pack("!I", total_length))
        self.write_delimited(header_bytes)
        self.write_delimited(sasl_bytes)

        # Gets negotiate response
        bytes = self.recv_rpc_message()
        resp = self.parse_response(bytes, RpcSaslProto)

        chosen_auth = None
        for auth in resp.auths:
            if auth.method == "TOKEN" and auth.mechanism == "DIGEST-MD5":
                chosen_auth = auth

        if chosen_auth is None:
            raise IOError("Token digest-MD5 authentication not supported by server")

        # Prepares initiate request

        self.sasl = SASLClient(
            chosen_auth.serverId,
            chosen_auth.protocol,
            mechanism=chosen_auth.mechanism,
            username=base64.b64encode(token["identifier"]),
            password=base64.b64encode(token["password"]),
        )

        challenge_resp = self.sasl.process(chosen_auth.challenge)

        auth = RpcSaslProto.SaslAuth()
        auth.method = chosen_auth.method
        auth.mechanism = chosen_auth.mechanism
        auth.protocol = chosen_auth.protocol
        auth.serverId = chosen_auth.serverId

        initiate_request = RpcSaslProto()
        initiate_request.state = RpcSaslProto.INITIATE
        initiate_request.version = 0
        initiate_request.auths.extend([auth])
        initiate_request.token = challenge_resp

        sasl_bytes = initiate_request.SerializeToString()

        total_length = (
            len(header_bytes)
            + len(sasl_bytes)
            + encoder._VarintSize(len(header_bytes))
            + encoder._VarintSize(len(sasl_bytes))
        )

        # Sends initiate request
        self.write(struct.pack("!I", total_length))

 def createSASLClient(self, host, service, mechanism, **kwargs):
     self.sasl = SASLClient(host, service, mechanism, **kwargs)

class ThriftSASLClientProtocol(ThriftClientProtocol):

    START = 1
    OK = 2
    BAD = 3
    ERROR = 4
    COMPLETE = 5

    MAX_LENGTH = 2 ** 31 - 1

    def __init__(self, client_class, iprot_factory, oprot_factory=None,
            host=None, service=None, mechanism='GSSAPI', **sasl_kwargs):
        ThriftClientProtocol.__init__(self, client_class, iprot_factory, oprot_factory)

        self._sasl_negotiation_deferred = None
        self._sasl_negotiation_status = None
        self.client = None

        if host is not None:
            self.createSASLClient(host, service, mechanism, **sasl_kwargs)

    def createSASLClient(self, host, service, mechanism, **kwargs):
        self.sasl = SASLClient(host, service, mechanism, **kwargs)

    def dispatch(self, msg):
        encoded = self.sasl.wrap(msg)
        len_and_encoded = ''.join((struct.pack('!i', len(encoded)), encoded))
        ThriftClientProtocol.dispatch(self, len_and_encoded)

    @defer.inlineCallbacks
    def connectionMade(self):
        self._sendSASLMessage(self.START, self.sasl.mechanism)
        initial_message = yield deferToThread(self.sasl.process)
        self._sendSASLMessage(self.OK, initial_message)

        while True:
            status, challenge = yield self._receiveSASLMessage()
            if status == self.OK:
                response = yield deferToThread(self.sasl.process, challenge)
                self._sendSASLMessage(self.OK, response)
            elif status == self.COMPLETE:
                if not self.sasl.complete:
                    msg = "The server erroneously indicated that SASL " \
                          "negotiation was complete"
                    raise TTransportException(msg, message=msg)
                else:
                    break
            else:
                msg = "Bad SASL negotiation status: %d (%s)" % (status, challenge)
                raise TTransportException(msg, message=msg)

        self._sasl_negotiation_deferred = None
        ThriftClientProtocol.connectionMade(self)

    def _sendSASLMessage(self, status, body):
        if body is None:
            body = ""
        header = struct.pack(">BI", status, len(body))
        self.transport.write(header + body)

    def _receiveSASLMessage(self):
        self._sasl_negotiation_deferred = defer.Deferred()
        self._sasl_negotiation_status = None
        return self._sasl_negotiation_deferred

    def connectionLost(self, reason=connectionDone):
        if self.client:
            ThriftClientProtocol.connectionLost(self, reason)

    def dataReceived(self, data):
        if self._sasl_negotiation_deferred:
            # we got a sasl challenge in the format (status, length, challenge)
            # save the status, let IntNStringReceiver piece the challenge data together
            self._sasl_negotiation_status, = struct.unpack("B", data[0])
            ThriftClientProtocol.dataReceived(self, data[1:])
        else:
            # normal frame, let IntNStringReceiver piece it together
            ThriftClientProtocol.dataReceived(self, data)

    def stringReceived(self, frame):
        if self._sasl_negotiation_deferred:
            # the frame is just a SASL challenge
            response = (self._sasl_negotiation_status, frame)
            self._sasl_negotiation_deferred.callback(response)
        else:
            # there's a second 4 byte length prefix inside the frame
            decoded_frame = self.sasl.unwrap(frame[4:])
            ThriftClientProtocol.stringReceived(self, decoded_frame)

 def __init__(self, host, service, mechanism='GSSAPI', **sasl_kwargs):
     if SASLClient is None:
         raise ImportError('The puresasl library has not been installed')
     self.sasl = SASLClient(host, service, mechanism, **sasl_kwargs)