Python kerberos.authGSSClientInit方法代码示例

# 需要导入模块: import kerberos [as 别名]
# 或者: from kerberos import authGSSClientInit [as 别名]
def _set_username(self, **kwargs):
        if self._username is not None:
            return
        try:
            (ret, ctx) = kerberos.authGSSClientInit('krbtgt@REDHAT.COM')
            assert (ret == kerberos.AUTH_GSS_COMPLETE)
            ret = kerberos.authGSSClientInquireCred(ctx)
            assert (ret == kerberos.AUTH_GSS_COMPLETE)
            # XXX What if you have >1 ticket?
            ret = kerberos.authGSSClientUserName(ctx)
            if '@' in ret:
                self._username = ret.split('@')[0]
            else:
                self._username = ret
        except AssertionError:
            raise ErrataException('Pigeon crap. Did it forget to run kinit?')

    # Shortcut 

# 需要导入模块: import kerberos [as 别名]
# 或者: from kerberos import authGSSClientInit [as 别名]
def refresh_auth(self):
        service = "HTTP@" + self.hostname
        flags = kerberos.GSS_C_MUTUAL_FLAG | kerberos.GSS_C_SEQUENCE_FLAG
        try:
            (_, vc) = kerberos.authGSSClientInit(service, flags)
        except kerberos.GSSError as e:
            LOG.error(_LE("caught kerberos exception %r") % e)
            raise IPAAuthError(str(e))
        try:
            kerberos.authGSSClientStep(vc, "")
        except kerberos.GSSError as e:
            LOG.error(_LE("caught kerberos exception %r") % e)
            raise IPAAuthError(str(e))
        self.token = kerberos.authGSSClientResponse(vc) 

# 需要导入模块: import kerberos [as 别名]
# 或者: from kerberos import authGSSClientInit [as 别名]
def get_auth_header(self):
        if self.ctx:
            raise RuntimeError("Context has already been initialized")
        __, self.ctx = kerberos.authGSSClientInit(self.service, principal = self.principal)
        kerberos.authGSSClientStep(self.ctx, "")
        token = kerberos.authGSSClientResponse(self.ctx)
        return {"Authorization": "Negotiate " + token} 

# 需要导入模块: import kerberos [as 别名]
# 或者: from kerberos import authGSSClientInit [as 别名]
def gssclient_token(self):
        os.environ['KRB5_CLIENT_KTNAME'] = self.IQUOTA_KEYTAB

        service = "HTTP@" + self.IQUOTA_API_HOST

        try:
            (_, vc) = kerberos.authGSSClientInit(service)
            kerberos.authGSSClientStep(vc, "")
            return kerberos.authGSSClientResponse(vc)
        except kerberos.GSSError as e:
            raise KerberosError('error initializing GSS client') 

# 需要导入模块: import kerberos [as 别名]
# 或者: from kerberos import authGSSClientInit [as 别名]
def _create_kerberos_session(self, kerberos_service):
        try:
            import kerberos as kerb
        except ImportError as e:
            log.debug(e)
            try:
                import kerberos_sspi as kerb
            except ImportError:
                raise ImportError("No kerberos implementation available")
        __, krb_context = kerb.authGSSClientInit(kerberos_service)
        kerb.authGSSClientStep(krb_context, "")
        auth_header = ("Negotiate " + kerb.authGSSClientResponse(krb_context))
        self._update_header("Authorization", auth_header)
        response = self._session.get(self.url, verify=self.verify_ssl)
        response.raise_for_status() 

# 需要导入模块: import kerberos [as 别名]
# 或者: from kerberos import authGSSClientInit [as 别名]
def _negotiate_get_svctk(self, spn, authdata):
    if authdata is None:
      return None

    result, self.context = kerberos.authGSSClientInit(spn)
    if result < kerberos.AUTH_GSS_COMPLETE:
      return None

    result = kerberos.authGSSClientStep(self.context, authdata)
    if result < kerberos.AUTH_GSS_CONTINUE:
      return None

    response = kerberos.authGSSClientResponse(self.context)
    return "Negotiate %s" % response 

# 需要导入模块: import kerberos [as 别名]
# 或者: from kerberos import authGSSClientInit [as 别名]
def pre_request(self, resp):
        # TODO: convert errors to some common error class
        import kerberos

        _, context = kerberos.authGSSClientInit(
            "HTTP@%s" % resp.url.host,
            gssflags=kerberos.GSS_C_MUTUAL_FLAG | kerberos.GSS_C_SEQUENCE_FLAG,
        )
        kerberos.authGSSClientStep(context, "")
        response = kerberos.authGSSClientResponse(context)
        headers = {"Authorization": "Negotiate " + response}
        return headers, context 

# 需要导入模块: import kerberos [as 别名]
# 或者: from kerberos import authGSSClientInit [as 别名]
def start(self, username, authzid):
        self.username = username
        self.authzid = authzid
        _unused, self._gss = kerberos.authGSSClientInit(authzid or 
                        "{0}@{1}".format("xmpp", 
                                    self.password_manager.get_serv_host()))
        self.step = 0
        return self.challenge("") 

# 需要导入模块: import kerberos [as 别名]
# 或者: from kerberos import authGSSClientInit [as 别名]
def setup(self, name):
            authzid = self.credentials['authzid']
            if not authzid:
                authzid = 'xmpp@%s' % self.credentials['service-name']

            _, self.gss = kerberos.authGSSClientInit(authzid)
            self.step = 0 

# 需要导入模块: import kerberos [as 别名]
# 或者: from kerberos import authGSSClientInit [as 别名]
def _get_bearer_saml_assertion_lin(self,
                                       request_duration=60,
                                       token_duration=600,
                                       delegatable=False,
                                       renewable=False):
        '''
        Extracts the assertion from the Bearer Token received from the Security
        Token Service using kerberos.

        @type  request_duration: C{long}
        @param request_duration: The duration for which the request is valid. If
                                 the STS receives this request after this
                                 duration, it is assumed to have expired. The
                                 duration is in seconds and the default is 60s.
        @type    token_duration: C{long}
        @param   token_duration: The duration for which the SAML token is issued
                                 for. The duration is specified in seconds and
                                 the default is 600s.
        @type       delegatable: C{boolean}
        @param      delegatable: Whether the generated token is delegatable or not
                                 The default value is False
        @type         renewable: C{boolean}
        @param        renewable: Whether the generated token is renewable or not
                                 The default value is False
        @rtype: C{str}
        @return: The SAML assertion in Unicode.
        '''
        import kerberos
        import platform
        service = 'host@%s' % platform.node()
        _, context = kerberos.authGSSClientInit(service, 0)
        challenge = ''
        # The following will keep running unless we receive a saml token or an error
        while True:
            # Call GSS step
            result = kerberos.authGSSClientStep(context, challenge)
            if result < 0:
                break
            sectoken = kerberos.authGSSClientResponse(context)
            soap_response = self._get_gss_soap_response(sectoken,
                                request_duration, token_duration, delegatable,
                                renewable)
            et = etree.fromstring(soap_response)
            try:
                # Check if we have received a challenge token from the server
                element = _extract_element(et,
                        'BinaryExchange',
                        {'ns': "http://docs.oasis-open.org/ws-sx/ws-trust/200512"})
                negotiate_token = element.text
                challenge = negotiate_token
            except KeyError:
                # Response does not contain the negotiate token.
                # It should contain SAML token then.
                saml_token = etree.tostring(
                    _extract_element(
                        et,
                        'Assertion',
                        {'saml2': "urn:oasis:names:tc:SAML:2.0:assertion"}),
                    pretty_print=False).decode(UTF_8)
                break
        return saml_token