Эх сурвалжийг харах

HUE-3287 [core] Django 1.11 upgrade
- Reverting to requests-kerberos-0.6.1

Prakash Ranade 7 жил өмнө
parent
commit
64ff0d23ae

+ 0 - 288
desktop/core/ext-py/requests-kerberos-0.12.0/PKG-INFO

@@ -1,288 +0,0 @@
-Metadata-Version: 1.0
-Name: requests-kerberos
-Version: 0.12.0
-Summary: A Kerberos authentication handler for python-requests
-Home-page: https://github.com/requests/requests-kerberos
-Author: Ian Cordasco, Cory Benfield, Michael Komitee
-Author-email: graffatcolmingov@gmail.com
-License: UNKNOWN
-Description-Content-Type: UNKNOWN
-Description: requests Kerberos/GSSAPI authentication library
-        ===============================================
-        
-        .. image:: https://travis-ci.org/requests/requests-kerberos.svg?branch=master
-            :target: https://travis-ci.org/requests/requests-kerberos
-        
-        .. image:: https://coveralls.io/repos/github/requests/requests-kerberos/badge.svg?branch=master
-            :target: https://coveralls.io/github/requests/requests-kerberos?branch=master
-        
-        Requests is an HTTP library, written in Python, for human beings. This library
-        adds optional Kerberos/GSSAPI authentication support and supports mutual
-        authentication. Basic GET usage:
-        
-        
-        .. code-block:: python
-        
-            >>> import requests
-            >>> from requests_kerberos import HTTPKerberosAuth
-            >>> r = requests.get("http://example.org", auth=HTTPKerberosAuth())
-            ...
-        
-        The entire ``requests.api`` should be supported.
-        
-        Authentication Failures
-        -----------------------
-        
-        Client authentication failures will be communicated to the caller by returning
-        the 401 response.
-        
-        Mutual Authentication
-        ---------------------
-        
-        REQUIRED
-        ^^^^^^^^
-        
-        By default, ``HTTPKerberosAuth`` will require mutual authentication from the
-        server, and if a server emits a non-error response which cannot be
-        authenticated, a ``requests_kerberos.errors.MutualAuthenticationError`` will
-        be raised. If a server emits an error which cannot be authenticated, it will
-        be returned to the user but with its contents and headers stripped. If the
-        response content is more important than the need for mutual auth on errors,
-        (eg, for certain WinRM calls) the stripping behavior can be suppressed by
-        setting ``sanitize_mutual_error_response=False``:
-        
-        .. code-block:: python
-        
-            >>> import requests
-            >>> from requests_kerberos import HTTPKerberosAuth, REQUIRED
-            >>> kerberos_auth = HTTPKerberosAuth(mutual_authentication=REQUIRED, sanitize_mutual_error_response=False)
-            >>> r = requests.get("https://windows.example.org/wsman", auth=kerberos_auth)
-            ...
-        
-        
-        OPTIONAL
-        ^^^^^^^^
-        
-        If you'd prefer to not require mutual authentication, you can set your
-        preference when constructing your ``HTTPKerberosAuth`` object:
-        
-        .. code-block:: python
-        
-            >>> import requests
-            >>> from requests_kerberos import HTTPKerberosAuth, OPTIONAL
-            >>> kerberos_auth = HTTPKerberosAuth(mutual_authentication=OPTIONAL)
-            >>> r = requests.get("http://example.org", auth=kerberos_auth)
-            ...
-        
-        This will cause ``requests_kerberos`` to attempt mutual authentication if the
-        server advertises that it supports it, and cause a failure if authentication
-        fails, but not if the server does not support it at all.
-        
-        DISABLED
-        ^^^^^^^^
-        
-        While we don't recommend it, if you'd prefer to never attempt mutual
-        authentication, you can do that as well:
-        
-        .. code-block:: python
-        
-            >>> import requests
-            >>> from requests_kerberos import HTTPKerberosAuth, DISABLED
-            >>> kerberos_auth = HTTPKerberosAuth(mutual_authentication=DISABLED)
-            >>> r = requests.get("http://example.org", auth=kerberos_auth)
-            ...
-        
-        Preemptive Authentication
-        -------------------------
-        
-        ``HTTPKerberosAuth`` can be forced to preemptively initiate the Kerberos
-        GSS exchange and present a Kerberos ticket on the initial request (and all
-        subsequent). By default, authentication only occurs after a
-        ``401 Unauthorized`` response containing a Kerberos or Negotiate challenge
-        is received from the origin server. This can cause mutual authentication
-        failures for hosts that use a persistent connection (eg, Windows/WinRM), as
-        no Kerberos challenges are sent after the initial auth handshake. This
-        behavior can be altered by setting  ``force_preemptive=True``:
-        
-        .. code-block:: python
-            
-            >>> import requests
-            >>> from requests_kerberos import HTTPKerberosAuth, REQUIRED
-            >>> kerberos_auth = HTTPKerberosAuth(mutual_authentication=REQUIRED, force_preemptive=True)
-            >>> r = requests.get("https://windows.example.org/wsman", auth=kerberos_auth)
-            ...
-        
-        Hostname Override
-        -----------------
-        
-        If communicating with a host whose DNS name doesn't match its
-        kerberos hostname (eg, behind a content switch or load balancer),
-        the hostname used for the Kerberos GSS exchange can be overridden by
-        setting the ``hostname_override`` arg:
-        
-        .. code-block:: python
-        
-            >>> import requests
-            >>> from requests_kerberos import HTTPKerberosAuth, REQUIRED
-            >>> kerberos_auth = HTTPKerberosAuth(hostname_override="internalhost.local")
-            >>> r = requests.get("https://externalhost.example.org/", auth=kerberos_auth)
-            ...
-        
-        Explicit Principal
-        ------------------
-        
-        ``HTTPKerberosAuth`` normally uses the default principal (ie, the user for
-        whom you last ran ``kinit`` or ``kswitch``, or an SSO credential if
-        applicable). However, an explicit principal can be specified, which will
-        cause Kerberos to look for a matching credential cache for the named user.
-        This feature depends on OS support for collection-type credential caches,
-        as well as working principal support in PyKerberos (it is broken in many
-        builds). An explicit principal can be specified with the ``principal`` arg:
-        
-        .. code-block:: python
-        
-            >>> import requests
-            >>> from requests_kerberos import HTTPKerberosAuth, REQUIRED
-            >>> kerberos_auth = HTTPKerberosAuth(principal="user@REALM")
-            >>> r = requests.get("http://example.org", auth=kerberos_auth)
-            ...
-        
-        On Windows, WinKerberos is used instead of PyKerberos. WinKerberos allows the
-        use of arbitrary principals instead of a credential cache. Passwords can be
-        specified by following the form ``user@realm:password`` for ``principal``.
-        
-        Delegation
-        ----------
-        
-        ``requests_kerberos`` supports credential delegation (``GSS_C_DELEG_FLAG``).
-        To enable delegation of credentials to a server that requests delegation, pass
-        ``delegate=True`` to ``HTTPKerberosAuth``:
-        
-        .. code-block:: python
-        
-            >>> import requests
-            >>> from requests_kerberos import HTTPKerberosAuth
-            >>> r = requests.get("http://example.org", auth=HTTPKerberosAuth(delegate=True))
-            ...
-        
-        Be careful to only allow delegation to servers you trust as they will be able
-        to impersonate you using the delegated credentials.
-        
-        Logging
-        -------
-        
-        This library makes extensive use of Python's logging facilities.
-        
-        Log messages are logged to the ``requests_kerberos`` and
-        ``requests_kerberos.kerberos_`` named loggers.
-        
-        If you are having difficulty we suggest you configure logging. Issues with the
-        underlying kerberos libraries will be made apparent. Additionally, copious debug
-        information is made available which may assist in troubleshooting if you
-        increase your log level all the way up to debug.
-        
-        
-        History
-        =======
-        
-        0.12.0: 2017-12-20
-        ------------------------
-        
-        - Add support for channel binding tokens (assumes pykerberos support >= 1.2.1)
-        - Add support for kerberos message encryption (assumes pykerberos support >= 1.2.1)
-        - Misc CI/test fixes
-        
-        0.11.0: 2016-11-02
-        ------------------
-        
-        - Switch dependency on Windows from kerberos-sspi/pywin32 to WinKerberos.
-          This brings Custom Principal support to Windows users.
-        
-        0.10.0: 2016-05-18
-        ------------------
-        
-        - Make it possible to receive errors without having their contents and headers
-          stripped.
-        - Resolve a bug caused by passing the ``principal`` keyword argument to
-          kerberos-sspi on Windows.
-        
-        0.9.0: 2016-05-06
-        -----------------
-        
-        - Support for principal, hostname, and realm override.
-        
-        - Added support for mutual auth.
-        
-        0.8.0: 2016-01-07
-        -----------------
-        
-        - Support for Kerberos delegation.
-        
-        - Fixed problems declaring kerberos-sspi on Windows installs.
-        
-        0.7.0: 2015-05-04
-        -----------------
-        
-        - Added Windows native authentication support by adding kerberos-sspi as an
-          alternative backend.
-        
-        - Prevent infinite recursion when a server returns 401 to an authorization
-          attempt.
-        
-        - Reduce the logging during successful responses.
-        
-        0.6.1: 2014-11-14
-        -----------------
-        
-        - Fix HTTPKerberosAuth not to treat non-file as a file
-        
-        - Prevent infinite recursion when GSSErrors occurs
-        
-        0.6: 2014-11-04
-        ---------------
-        
-        - Handle mutual authentication (see pull request 36_)
-        
-          All users should upgrade immediately. This has been reported to
-          oss-security_ and we are awaiting a proper CVE identifier.
-        
-          **Update**: We were issued CVE-2014-8650
-        
-        - Distribute as a wheel.
-        
-        .. _36: https://github.com/requests/requests-kerberos/pull/36
-        .. _oss-security: http://www.openwall.com/lists/oss-security/
-        
-        0.5: 2014-05-14
-        ---------------
-        
-        - Allow non-HTTP service principals with HTTPKerberosAuth using a new optional
-          argument ``service``.
-        
-        - Fix bug in ``setup.py`` on distributions where the ``compiler`` module is
-          not available.
-        
-        - Add test dependencies to ``setup.py`` so ``python setup.py test`` will work.
-        
-        0.4: 2013-10-26
-        ---------------
-        
-        - Minor updates in the README
-        - Change requirements to depend on requests above 1.1.0
-        
-        0.3: 2013-06-02
-        ---------------
-        
-        - Work with servers operating on non-standard ports
-        
-        0.2: 2013-03-26
-        ---------------
-        
-        - Not documented
-        
-        0.1: Never released
-        -------------------
-        
-        - Initial Release
-        
-Platform: UNKNOWN

+ 0 - 173
desktop/core/ext-py/requests-kerberos-0.12.0/README.rst

@@ -1,173 +0,0 @@
-requests Kerberos/GSSAPI authentication library
-===============================================
-
-.. image:: https://travis-ci.org/requests/requests-kerberos.svg?branch=master
-    :target: https://travis-ci.org/requests/requests-kerberos
-
-.. image:: https://coveralls.io/repos/github/requests/requests-kerberos/badge.svg?branch=master
-    :target: https://coveralls.io/github/requests/requests-kerberos?branch=master
-
-Requests is an HTTP library, written in Python, for human beings. This library
-adds optional Kerberos/GSSAPI authentication support and supports mutual
-authentication. Basic GET usage:
-
-
-.. code-block:: python
-
-    >>> import requests
-    >>> from requests_kerberos import HTTPKerberosAuth
-    >>> r = requests.get("http://example.org", auth=HTTPKerberosAuth())
-    ...
-
-The entire ``requests.api`` should be supported.
-
-Authentication Failures
------------------------
-
-Client authentication failures will be communicated to the caller by returning
-the 401 response.
-
-Mutual Authentication
----------------------
-
-REQUIRED
-^^^^^^^^
-
-By default, ``HTTPKerberosAuth`` will require mutual authentication from the
-server, and if a server emits a non-error response which cannot be
-authenticated, a ``requests_kerberos.errors.MutualAuthenticationError`` will
-be raised. If a server emits an error which cannot be authenticated, it will
-be returned to the user but with its contents and headers stripped. If the
-response content is more important than the need for mutual auth on errors,
-(eg, for certain WinRM calls) the stripping behavior can be suppressed by
-setting ``sanitize_mutual_error_response=False``:
-
-.. code-block:: python
-
-    >>> import requests
-    >>> from requests_kerberos import HTTPKerberosAuth, REQUIRED
-    >>> kerberos_auth = HTTPKerberosAuth(mutual_authentication=REQUIRED, sanitize_mutual_error_response=False)
-    >>> r = requests.get("https://windows.example.org/wsman", auth=kerberos_auth)
-    ...
-
-
-OPTIONAL
-^^^^^^^^
-
-If you'd prefer to not require mutual authentication, you can set your
-preference when constructing your ``HTTPKerberosAuth`` object:
-
-.. code-block:: python
-
-    >>> import requests
-    >>> from requests_kerberos import HTTPKerberosAuth, OPTIONAL
-    >>> kerberos_auth = HTTPKerberosAuth(mutual_authentication=OPTIONAL)
-    >>> r = requests.get("http://example.org", auth=kerberos_auth)
-    ...
-
-This will cause ``requests_kerberos`` to attempt mutual authentication if the
-server advertises that it supports it, and cause a failure if authentication
-fails, but not if the server does not support it at all.
-
-DISABLED
-^^^^^^^^
-
-While we don't recommend it, if you'd prefer to never attempt mutual
-authentication, you can do that as well:
-
-.. code-block:: python
-
-    >>> import requests
-    >>> from requests_kerberos import HTTPKerberosAuth, DISABLED
-    >>> kerberos_auth = HTTPKerberosAuth(mutual_authentication=DISABLED)
-    >>> r = requests.get("http://example.org", auth=kerberos_auth)
-    ...
-
-Preemptive Authentication
--------------------------
-
-``HTTPKerberosAuth`` can be forced to preemptively initiate the Kerberos
-GSS exchange and present a Kerberos ticket on the initial request (and all
-subsequent). By default, authentication only occurs after a
-``401 Unauthorized`` response containing a Kerberos or Negotiate challenge
-is received from the origin server. This can cause mutual authentication
-failures for hosts that use a persistent connection (eg, Windows/WinRM), as
-no Kerberos challenges are sent after the initial auth handshake. This
-behavior can be altered by setting  ``force_preemptive=True``:
-
-.. code-block:: python
-    
-    >>> import requests
-    >>> from requests_kerberos import HTTPKerberosAuth, REQUIRED
-    >>> kerberos_auth = HTTPKerberosAuth(mutual_authentication=REQUIRED, force_preemptive=True)
-    >>> r = requests.get("https://windows.example.org/wsman", auth=kerberos_auth)
-    ...
-
-Hostname Override
------------------
-
-If communicating with a host whose DNS name doesn't match its
-kerberos hostname (eg, behind a content switch or load balancer),
-the hostname used for the Kerberos GSS exchange can be overridden by
-setting the ``hostname_override`` arg:
-
-.. code-block:: python
-
-    >>> import requests
-    >>> from requests_kerberos import HTTPKerberosAuth, REQUIRED
-    >>> kerberos_auth = HTTPKerberosAuth(hostname_override="internalhost.local")
-    >>> r = requests.get("https://externalhost.example.org/", auth=kerberos_auth)
-    ...
-
-Explicit Principal
-------------------
-
-``HTTPKerberosAuth`` normally uses the default principal (ie, the user for
-whom you last ran ``kinit`` or ``kswitch``, or an SSO credential if
-applicable). However, an explicit principal can be specified, which will
-cause Kerberos to look for a matching credential cache for the named user.
-This feature depends on OS support for collection-type credential caches,
-as well as working principal support in PyKerberos (it is broken in many
-builds). An explicit principal can be specified with the ``principal`` arg:
-
-.. code-block:: python
-
-    >>> import requests
-    >>> from requests_kerberos import HTTPKerberosAuth, REQUIRED
-    >>> kerberos_auth = HTTPKerberosAuth(principal="user@REALM")
-    >>> r = requests.get("http://example.org", auth=kerberos_auth)
-    ...
-
-On Windows, WinKerberos is used instead of PyKerberos. WinKerberos allows the
-use of arbitrary principals instead of a credential cache. Passwords can be
-specified by following the form ``user@realm:password`` for ``principal``.
-
-Delegation
-----------
-
-``requests_kerberos`` supports credential delegation (``GSS_C_DELEG_FLAG``).
-To enable delegation of credentials to a server that requests delegation, pass
-``delegate=True`` to ``HTTPKerberosAuth``:
-
-.. code-block:: python
-
-    >>> import requests
-    >>> from requests_kerberos import HTTPKerberosAuth
-    >>> r = requests.get("http://example.org", auth=HTTPKerberosAuth(delegate=True))
-    ...
-
-Be careful to only allow delegation to servers you trust as they will be able
-to impersonate you using the delegated credentials.
-
-Logging
--------
-
-This library makes extensive use of Python's logging facilities.
-
-Log messages are logged to the ``requests_kerberos`` and
-``requests_kerberos.kerberos_`` named loggers.
-
-If you are having difficulty we suggest you configure logging. Issues with the
-underlying kerberos libraries will be made apparent. Additionally, copious debug
-information is made available which may assist in troubleshooting if you
-increase your log level all the way up to debug.

+ 0 - 452
desktop/core/ext-py/requests-kerberos-0.12.0/requests_kerberos/kerberos_.py

@@ -1,452 +0,0 @@
-try:
-    import kerberos
-except ImportError:
-    import winkerberos as kerberos
-import logging
-import re
-import sys
-import warnings
-
-from cryptography import x509
-from cryptography.hazmat.backends import default_backend
-from cryptography.hazmat.primitives import hashes
-from cryptography.exceptions import UnsupportedAlgorithm
-
-from requests.auth import AuthBase
-from requests.models import Response
-from requests.compat import urlparse, StringIO
-from requests.structures import CaseInsensitiveDict
-from requests.cookies import cookiejar_from_dict
-from requests.packages.urllib3 import HTTPResponse
-
-from .exceptions import MutualAuthenticationError, KerberosExchangeError
-
-log = logging.getLogger(__name__)
-
-# Different types of mutual authentication:
-#  with mutual_authentication set to REQUIRED, all responses will be
-#   authenticated with the exception of errors. Errors will have their contents
-#   and headers stripped. If a non-error response cannot be authenticated, a
-#   MutualAuthenticationError exception will be raised.
-# with mutual_authentication set to OPTIONAL, mutual authentication will be
-#   attempted if supported, and if supported and failed, a
-#   MutualAuthenticationError exception will be raised. Responses which do not
-#   support mutual authentication will be returned directly to the user.
-# with mutual_authentication set to DISABLED, mutual authentication will not be
-#   attempted, even if supported.
-REQUIRED = 1
-OPTIONAL = 2
-DISABLED = 3
-
-
-class NoCertificateRetrievedWarning(Warning):
-    pass
-
-class UnknownSignatureAlgorithmOID(Warning):
-    pass
-
-
-class SanitizedResponse(Response):
-    """The :class:`Response <Response>` object, which contains a server's
-    response to an HTTP request.
-
-    This differs from `requests.models.Response` in that it's headers and
-    content have been sanitized. This is only used for HTTP Error messages
-    which do not support mutual authentication when mutual authentication is
-    required."""
-
-    def __init__(self, response):
-        super(SanitizedResponse, self).__init__()
-        self.status_code = response.status_code
-        self.encoding = response.encoding
-        self.raw = response.raw
-        self.reason = response.reason
-        self.url = response.url
-        self.request = response.request
-        self.connection = response.connection
-        self._content_consumed = True
-
-        self._content = ""
-        self.cookies = cookiejar_from_dict({})
-        self.headers = CaseInsensitiveDict()
-        self.headers['content-length'] = '0'
-        for header in ('date', 'server'):
-            if header in response.headers:
-                self.headers[header] = response.headers[header]
-
-
-def _negotiate_value(response):
-    """Extracts the gssapi authentication token from the appropriate header"""
-    if hasattr(_negotiate_value, 'regex'):
-        regex = _negotiate_value.regex
-    else:
-        # There's no need to re-compile this EVERY time it is called. Compile
-        # it once and you won't have the performance hit of the compilation.
-        regex = re.compile('(?:.*,)*\s*Negotiate\s*([^,]*),?', re.I)
-        _negotiate_value.regex = regex
-
-    authreq = response.headers.get('www-authenticate', None)
-
-    if authreq:
-        match_obj = regex.search(authreq)
-        if match_obj:
-            return match_obj.group(1)
-
-    return None
-
-
-def _get_certificate_hash(certificate_der):
-    # https://tools.ietf.org/html/rfc5929#section-4.1
-    cert = x509.load_der_x509_certificate(certificate_der, default_backend())
-
-    try:
-        hash_algorithm = cert.signature_hash_algorithm
-    except UnsupportedAlgorithm as ex:
-        warnings.warn("Failed to get signature algorithm from certificate, "
-                      "unable to pass channel bindings: %s" % str(ex), UnknownSignatureAlgorithmOID)
-        return None
-
-    # if the cert signature algorithm is either md5 or sha1 then use sha256
-    # otherwise use the signature algorithm
-    if hash_algorithm.name in ['md5', 'sha1']:
-        digest = hashes.Hash(hashes.SHA256(), default_backend())
-    else:
-        digest = hashes.Hash(hash_algorithm, default_backend())
-
-    digest.update(certificate_der)
-    certificate_hash = digest.finalize()
-
-    return certificate_hash
-
-
-def _get_channel_bindings_application_data(response):
-    """
-    https://tools.ietf.org/html/rfc5929 4. The 'tls-server-end-point' Channel Binding Type
-
-    Gets the application_data value for the 'tls-server-end-point' CBT Type.
-    This is ultimately the SHA256 hash of the certificate of the HTTPS endpoint
-    appended onto tls-server-end-point. This value is then passed along to the
-    kerberos library to bind to the auth response. If the socket is not an SSL
-    socket or the raw HTTP object is not a urllib3 HTTPResponse then None will
-    be returned and the Kerberos auth will use GSS_C_NO_CHANNEL_BINDINGS
-
-    :param response: The original 401 response from the server
-    :return: byte string used on the application_data.value field on the CBT struct
-    """
-
-    application_data = None
-    raw_response = response.raw
-
-    if isinstance(raw_response, HTTPResponse):
-        try:
-            if sys.version_info > (3, 0):
-                socket = raw_response._fp.fp.raw._sock
-            else:
-                socket = raw_response._fp.fp._sock
-        except AttributeError:
-            warnings.warn("Failed to get raw socket for CBT; has urllib3 impl changed",
-                          NoCertificateRetrievedWarning)
-        else:
-            try:
-                server_certificate = socket.getpeercert(True)
-            except AttributeError:
-                pass
-            else:
-                certificate_hash = _get_certificate_hash(server_certificate)
-                application_data = b'tls-server-end-point:' + certificate_hash
-    else:
-        warnings.warn(
-            "Requests is running with a non urllib3 backend, cannot retrieve server certificate for CBT",
-            NoCertificateRetrievedWarning)
-
-    return application_data
-
-class HTTPKerberosAuth(AuthBase):
-    """Attaches HTTP GSSAPI/Kerberos Authentication to the given Request
-    object."""
-    def __init__(
-            self, mutual_authentication=REQUIRED,
-            service="HTTP", delegate=False, force_preemptive=False,
-            principal=None, hostname_override=None,
-            sanitize_mutual_error_response=True, send_cbt=True):
-        self.context = {}
-        self.mutual_authentication = mutual_authentication
-        self.delegate = delegate
-        self.pos = None
-        self.service = service
-        self.force_preemptive = force_preemptive
-        self.principal = principal
-        self.hostname_override = hostname_override
-        self.sanitize_mutual_error_response = sanitize_mutual_error_response
-        self.auth_done = False
-        self.winrm_encryption_available = hasattr(kerberos, 'authGSSWinRMEncryptMessage')
-
-        # Set the CBT values populated after the first response
-        self.send_cbt = send_cbt
-        self.cbt_binding_tried = False
-        self.cbt_struct = None
-
-    def generate_request_header(self, response, host, is_preemptive=False):
-        """
-        Generates the GSSAPI authentication token with kerberos.
-
-        If any GSSAPI step fails, raise KerberosExchangeError
-        with failure detail.
-
-        """
-
-        # Flags used by kerberos module.
-        gssflags = kerberos.GSS_C_MUTUAL_FLAG | kerberos.GSS_C_SEQUENCE_FLAG
-        if self.delegate:
-            gssflags |= kerberos.GSS_C_DELEG_FLAG
-
-        try:
-            kerb_stage = "authGSSClientInit()"
-            # contexts still need to be stored by host, but hostname_override
-            # allows use of an arbitrary hostname for the kerberos exchange
-            # (eg, in cases of aliased hosts, internal vs external, CNAMEs
-            # w/ name-based HTTP hosting)
-            kerb_host = self.hostname_override if self.hostname_override is not None else host
-            kerb_spn = "{0}@{1}".format(self.service, kerb_host)
-
-            result, self.context[host] = kerberos.authGSSClientInit(kerb_spn,
-                gssflags=gssflags, principal=self.principal)
-
-            if result < 1:
-                raise EnvironmentError(result, kerb_stage)
-
-            # if we have a previous response from the server, use it to continue
-            # the auth process, otherwise use an empty value
-            negotiate_resp_value = '' if is_preemptive else _negotiate_value(response)
-
-            kerb_stage = "authGSSClientStep()"
-            # If this is set pass along the struct to Kerberos
-            if self.cbt_struct:
-                result = kerberos.authGSSClientStep(self.context[host],
-                                                    negotiate_resp_value,
-                                                    channel_bindings=self.cbt_struct)
-            else:
-                result = kerberos.authGSSClientStep(self.context[host],
-                                                    negotiate_resp_value)
-
-            if result < 0:
-                raise EnvironmentError(result, kerb_stage)
-
-            kerb_stage = "authGSSClientResponse()"
-            gss_response = kerberos.authGSSClientResponse(self.context[host])
-
-            return "Negotiate {0}".format(gss_response)
-
-        except kerberos.GSSError as error:
-            log.exception(
-                "generate_request_header(): {0} failed:".format(kerb_stage))
-            log.exception(error)
-            raise KerberosExchangeError("%s failed: %s" % (kerb_stage, str(error.args)))
-
-        except EnvironmentError as error:
-            # ensure we raised this for translation to KerberosExchangeError
-            # by comparing errno to result, re-raise if not
-            if error.errno != result:
-                raise
-            message = "{0} failed, result: {1}".format(kerb_stage, result)
-            log.error("generate_request_header(): {0}".format(message))
-            raise KerberosExchangeError(message)
-
-    def authenticate_user(self, response, **kwargs):
-        """Handles user authentication with gssapi/kerberos"""
-
-        host = urlparse(response.url).hostname
-
-        try:
-            auth_header = self.generate_request_header(response, host)
-        except KerberosExchangeError:
-            # GSS Failure, return existing response
-            return response
-
-        log.debug("authenticate_user(): Authorization header: {0}".format(
-            auth_header))
-        response.request.headers['Authorization'] = auth_header
-
-        # Consume the content so we can reuse the connection for the next
-        # request.
-        response.content
-        response.raw.release_conn()
-
-        _r = response.connection.send(response.request, **kwargs)
-        _r.history.append(response)
-
-        log.debug("authenticate_user(): returning {0}".format(_r))
-        return _r
-
-    def handle_401(self, response, **kwargs):
-        """Handles 401's, attempts to use gssapi/kerberos authentication"""
-
-        log.debug("handle_401(): Handling: 401")
-        if _negotiate_value(response) is not None:
-            _r = self.authenticate_user(response, **kwargs)
-            log.debug("handle_401(): returning {0}".format(_r))
-            return _r
-        else:
-            log.debug("handle_401(): Kerberos is not supported")
-            log.debug("handle_401(): returning {0}".format(response))
-            return response
-
-    def handle_other(self, response):
-        """Handles all responses with the exception of 401s.
-
-        This is necessary so that we can authenticate responses if requested"""
-
-        log.debug("handle_other(): Handling: %d" % response.status_code)
-
-        if self.mutual_authentication in (REQUIRED, OPTIONAL) and not self.auth_done:
-
-            is_http_error = response.status_code >= 400
-
-            if _negotiate_value(response) is not None:
-                log.debug("handle_other(): Authenticating the server")
-                if not self.authenticate_server(response):
-                    # Mutual authentication failure when mutual auth is wanted,
-                    # raise an exception so the user doesn't use an untrusted
-                    # response.
-                    log.error("handle_other(): Mutual authentication failed")
-                    raise MutualAuthenticationError("Unable to authenticate "
-                                                    "{0}".format(response))
-
-                # Authentication successful
-                log.debug("handle_other(): returning {0}".format(response))
-                self.auth_done = True
-                return response
-
-            elif is_http_error or self.mutual_authentication == OPTIONAL:
-                if not response.ok:
-                    log.error("handle_other(): Mutual authentication unavailable "
-                              "on {0} response".format(response.status_code))
-
-                if(self.mutual_authentication == REQUIRED and
-                       self.sanitize_mutual_error_response):
-                    return SanitizedResponse(response)
-                else:
-                    return response
-            else:
-                # Unable to attempt mutual authentication when mutual auth is
-                # required, raise an exception so the user doesn't use an
-                # untrusted response.
-                log.error("handle_other(): Mutual authentication failed")
-                raise MutualAuthenticationError("Unable to authenticate "
-                                                "{0}".format(response))
-        else:
-            log.debug("handle_other(): returning {0}".format(response))
-            return response
-
-    def authenticate_server(self, response):
-        """
-        Uses GSSAPI to authenticate the server.
-
-        Returns True on success, False on failure.
-        """
-
-        log.debug("authenticate_server(): Authenticate header: {0}".format(
-            _negotiate_value(response)))
-
-        host = urlparse(response.url).hostname
-
-        try:
-            # If this is set pass along the struct to Kerberos
-            if self.cbt_struct:
-                result = kerberos.authGSSClientStep(self.context[host],
-                                                    _negotiate_value(response),
-                                                    channel_bindings=self.cbt_struct)
-            else:
-                result = kerberos.authGSSClientStep(self.context[host],
-                                                    _negotiate_value(response))
-        except kerberos.GSSError:
-            log.exception("authenticate_server(): authGSSClientStep() failed:")
-            return False
-
-        if result < 1:
-            log.error("authenticate_server(): authGSSClientStep() failed: "
-                      "{0}".format(result))
-            return False
-
-        log.debug("authenticate_server(): returning {0}".format(response))
-        return True
-
-    def handle_response(self, response, **kwargs):
-        """Takes the given response and tries kerberos-auth, as needed."""
-        num_401s = kwargs.pop('num_401s', 0)
-
-        # Check if we have already tried to get the CBT data value
-        if not self.cbt_binding_tried and self.send_cbt:
-            # If we haven't tried, try getting it now
-            cbt_application_data = _get_channel_bindings_application_data(response)
-            if cbt_application_data:
-                # Only the latest version of pykerberos has this method available
-                try:
-                    self.cbt_struct = kerberos.channelBindings(application_data=cbt_application_data)
-                except AttributeError:
-                    # Using older version set to None
-                    self.cbt_struct = None
-            # Regardless of the result, set tried to True so we don't waste time next time
-            self.cbt_binding_tried = True
-
-        if self.pos is not None:
-            # Rewind the file position indicator of the body to where
-            # it was to resend the request.
-            response.request.body.seek(self.pos)
-
-        if response.status_code == 401 and num_401s < 2:
-            # 401 Unauthorized. Handle it, and if it still comes back as 401,
-            # that means authentication failed.
-            _r = self.handle_401(response, **kwargs)
-            log.debug("handle_response(): returning %s", _r)
-            log.debug("handle_response() has seen %d 401 responses", num_401s)
-            num_401s += 1
-            return self.handle_response(_r, num_401s=num_401s, **kwargs)
-        elif response.status_code == 401 and num_401s >= 2:
-            # Still receiving 401 responses after attempting to handle them.
-            # Authentication has failed. Return the 401 response.
-            log.debug("handle_response(): returning 401 %s", response)
-            return response
-        else:
-            _r = self.handle_other(response)
-            log.debug("handle_response(): returning %s", _r)
-            return _r
-
-    def deregister(self, response):
-        """Deregisters the response handler"""
-        response.request.deregister_hook('response', self.handle_response)
-
-    def wrap_winrm(self, host, message):
-        if not self.winrm_encryption_available:
-            raise NotImplementedError("WinRM encryption is not available on the installed version of pykerberos")
-
-        return kerberos.authGSSWinRMEncryptMessage(self.context[host], message)
-
-    def unwrap_winrm(self, host, message, header):
-        if not self.winrm_encryption_available:
-            raise NotImplementedError("WinRM encryption is not available on the installed version of pykerberos")
-
-        return kerberos.authGSSWinRMDecryptMessage(self.context[host], message, header)
-
-    def __call__(self, request):
-        if self.force_preemptive and not self.auth_done:
-            # add Authorization header before we receive a 401
-            # by the 401 handler
-            host = urlparse(request.url).hostname
-
-            auth_header = self.generate_request_header(None, host, is_preemptive=True)
-
-            log.debug("HTTPKerberosAuth: Preemptive Authorization header: {0}".format(auth_header))
-
-            request.headers['Authorization'] = auth_header
-
-        request.register_hook('response', self.handle_response)
-        try:
-            self.pos = request.body.tell()
-        except AttributeError:
-            # In the case of HTTPKerberosAuth being reused and the body
-            # of the previous request was a file-like object, pos has
-            # the file position of the previous body. Ensure it's set to
-            # None.
-            self.pos = None
-        return request

+ 0 - 6
desktop/core/ext-py/requests-kerberos-0.12.0/requirements.txt

@@ -1,6 +0,0 @@
-requests>=1.1.0
-winkerberos >= 0.5.0; sys.platform == 'win32'
-pykerberos >= 1.1.8, < 2.0.0; sys.platform != 'win32'
-cryptography>=1.3
-cryptography>=1.3; python_version!="3.3"
-cryptography>=1.3, <2; python_version=="3.3"

+ 0 - 0
desktop/core/ext-py/requests-kerberos-0.12.0/AUTHORS → desktop/core/ext-py/requests-kerberos-0.6.1/AUTHORS


+ 0 - 46
desktop/core/ext-py/requests-kerberos-0.12.0/HISTORY.rst → desktop/core/ext-py/requests-kerberos-0.6.1/HISTORY.rst

@@ -1,52 +1,6 @@
 History
 =======
 
-0.12.0: 2017-12-20
-------------------------
-
-- Add support for channel binding tokens (assumes pykerberos support >= 1.2.1)
-- Add support for kerberos message encryption (assumes pykerberos support >= 1.2.1)
-- Misc CI/test fixes
-
-0.11.0: 2016-11-02
-------------------
-
-- Switch dependency on Windows from kerberos-sspi/pywin32 to WinKerberos.
-  This brings Custom Principal support to Windows users.
-
-0.10.0: 2016-05-18
-------------------
-
-- Make it possible to receive errors without having their contents and headers
-  stripped.
-- Resolve a bug caused by passing the ``principal`` keyword argument to
-  kerberos-sspi on Windows.
-
-0.9.0: 2016-05-06
------------------
-
-- Support for principal, hostname, and realm override.
-
-- Added support for mutual auth.
-
-0.8.0: 2016-01-07
------------------
-
-- Support for Kerberos delegation.
-
-- Fixed problems declaring kerberos-sspi on Windows installs.
-
-0.7.0: 2015-05-04
------------------
-
-- Added Windows native authentication support by adding kerberos-sspi as an
-  alternative backend.
-
-- Prevent infinite recursion when a server returns 401 to an authorization
-  attempt.
-
-- Reduce the logging during successful responses.
-
 0.6.1: 2014-11-14
 -----------------
 

+ 0 - 2
desktop/core/ext-py/requests-kerberos-0.12.0/LICENSE → desktop/core/ext-py/requests-kerberos-0.6.1/LICENSE

@@ -1,5 +1,3 @@
-ISC License
-
 Copyright (c) 2012 Kenneth Reitz
 
 Permission to use, copy, modify and/or distribute this software for any

+ 0 - 0
desktop/core/ext-py/requests-kerberos-0.12.0/MANIFEST.in → desktop/core/ext-py/requests-kerberos-0.6.1/MANIFEST.in


+ 144 - 0
desktop/core/ext-py/requests-kerberos-0.6.1/PKG-INFO

@@ -0,0 +1,144 @@
+Metadata-Version: 1.0
+Name: requests-kerberos
+Version: 0.6.1
+Summary: A Kerberos authentication handler for python-requests
+Home-page: https://github.com/requests/requests-kerberos
+Author: Ian Cordasco, Cory Benfield, Michael Komitee
+Author-email: graffatcolmingov@gmail.com
+License: UNKNOWN
+Description: requests Kerberos/GSSAPI authentication library
+        ===============================================
+        
+        Requests is an HTTP library, written in Python, for human beings. This library
+        adds optional Kerberos/GSSAPI authentication support and supports mutual
+        authentication. Basic GET usage:
+        
+        
+        .. code-block:: pycon
+        
+            >>> import requests
+            >>> from requests_kerberos import HTTPKerberosAuth
+            >>> r = requests.get("http://example.org", auth=HTTPKerberosAuth())
+            ...
+        
+        The entire ``requests.api`` should be supported.
+        
+        Authentication Failures
+        -----------------------
+        
+        Client authentication failures will be communicated to the caller by returning
+        the 401 response.
+        
+        Mutual Authentication
+        ---------------------
+        
+        By default, ``HTTPKerberosAuth`` will require mutual authentication from the
+        server, and if a server emits a non-error response which cannot be
+        authenticated, a ``requests_kerberos.errors.MutualAuthenticationError`` will be
+        raised. If a server emits an error which cannot be authenticated, it will be
+        returned to the user but with its contents and headers stripped.
+        
+        OPTIONAL
+        ^^^^^^^^
+        
+        If you'd prefer to not require mutual authentication, you can set your
+        preference when constructing your ``HTTPKerberosAuth`` object:
+        
+        .. code-block:: pycon
+        
+            >>> import requests
+            >>> from requests_kerberos import HTTPKerberosAuth, OPTIONAL
+            >>> kerberos_auth = HTTPKerberosAuth(mutual_authentication=OPTIONAL)
+            >>> r = requests.get("http://example.org", auth=kerberos_auth)
+            ...
+        
+        This will cause ``requests_kerberos`` to attempt mutual authentication if the
+        server advertises that it supports it, and cause a failure if authentication
+        fails, but not if the server does not support it at all.
+        
+        DISABLED
+        ^^^^^^^^
+        
+        While we don't recommend it, if you'd prefer to never attempt mutual
+        authentication, you can do that as well:
+        
+        .. code-block:: pycon
+        
+            >>> import requests
+            >>> from requests_kerberos import HTTPKerberosAuth, DISABLED
+            >>> kerberos_auth = HTTPKerberosAuth(mutual_authentication=DISABLED)
+            >>> r = requests.get("http://example.org", auth=kerberos_auth)
+            ...
+        
+        Logging
+        -------
+        
+        This library makes extensive use of Python's logging facilities.
+        
+        Log messages are logged to the ``requests_kerberos`` and
+        ``requests_kerberos.kerberos_`` named loggers.
+        
+        If you are having difficulty we suggest you configure logging. Issues with the
+        underlying kerberos libraries will be made apparent. Additionally, copious debug
+        information is made available which may assist in troubleshooting if you
+        increase your log level all the way up to debug.
+        
+        
+        History
+        =======
+        
+        0.6.1: 2014-11-14
+        -----------------
+        
+        - Fix HTTPKerberosAuth not to treat non-file as a file
+        
+        - Prevent infinite recursion when GSSErrors occurs
+        
+        0.6: 2014-11-04
+        ---------------
+        
+        - Handle mutual authentication (see pull request 36_)
+        
+          All users should upgrade immediately. This has been reported to
+          oss-security_ and we are awaiting a proper CVE identifier.
+        
+          **Update**: We were issued CVE-2014-8650
+        
+        - Distribute as a wheel.
+        
+        .. _36: https://github.com/requests/requests-kerberos/pull/36
+        .. _oss-security: http://www.openwall.com/lists/oss-security/
+        
+        0.5: 2014-05-14
+        ---------------
+        
+        - Allow non-HTTP service principals with HTTPKerberosAuth using a new optional
+          argument ``service``.
+        
+        - Fix bug in ``setup.py`` on distributions where the ``compiler`` module is
+          not available.
+        
+        - Add test dependencies to ``setup.py`` so ``python setup.py test`` will work.
+        
+        0.4: 2013-10-26
+        ---------------
+        
+        - Minor updates in the README
+        - Change requirements to depend on requests above 1.1.0
+        
+        0.3: 2013-06-02
+        ---------------
+        
+        - Work with servers operating on non-standard ports
+        
+        0.2: 2013-03-26
+        ---------------
+        
+        - Not documented
+        
+        0.1: Never released
+        -------------------
+        
+        - Initial Release
+        
+Platform: UNKNOWN

+ 76 - 0
desktop/core/ext-py/requests-kerberos-0.6.1/README.rst

@@ -0,0 +1,76 @@
+requests Kerberos/GSSAPI authentication library
+===============================================
+
+Requests is an HTTP library, written in Python, for human beings. This library
+adds optional Kerberos/GSSAPI authentication support and supports mutual
+authentication. Basic GET usage:
+
+
+.. code-block:: pycon
+
+    >>> import requests
+    >>> from requests_kerberos import HTTPKerberosAuth
+    >>> r = requests.get("http://example.org", auth=HTTPKerberosAuth())
+    ...
+
+The entire ``requests.api`` should be supported.
+
+Authentication Failures
+-----------------------
+
+Client authentication failures will be communicated to the caller by returning
+the 401 response.
+
+Mutual Authentication
+---------------------
+
+By default, ``HTTPKerberosAuth`` will require mutual authentication from the
+server, and if a server emits a non-error response which cannot be
+authenticated, a ``requests_kerberos.errors.MutualAuthenticationError`` will be
+raised. If a server emits an error which cannot be authenticated, it will be
+returned to the user but with its contents and headers stripped.
+
+OPTIONAL
+^^^^^^^^
+
+If you'd prefer to not require mutual authentication, you can set your
+preference when constructing your ``HTTPKerberosAuth`` object:
+
+.. code-block:: pycon
+
+    >>> import requests
+    >>> from requests_kerberos import HTTPKerberosAuth, OPTIONAL
+    >>> kerberos_auth = HTTPKerberosAuth(mutual_authentication=OPTIONAL)
+    >>> r = requests.get("http://example.org", auth=kerberos_auth)
+    ...
+
+This will cause ``requests_kerberos`` to attempt mutual authentication if the
+server advertises that it supports it, and cause a failure if authentication
+fails, but not if the server does not support it at all.
+
+DISABLED
+^^^^^^^^
+
+While we don't recommend it, if you'd prefer to never attempt mutual
+authentication, you can do that as well:
+
+.. code-block:: pycon
+
+    >>> import requests
+    >>> from requests_kerberos import HTTPKerberosAuth, DISABLED
+    >>> kerberos_auth = HTTPKerberosAuth(mutual_authentication=DISABLED)
+    >>> r = requests.get("http://example.org", auth=kerberos_auth)
+    ...
+
+Logging
+-------
+
+This library makes extensive use of Python's logging facilities.
+
+Log messages are logged to the ``requests_kerberos`` and
+``requests_kerberos.kerberos_`` named loggers.
+
+If you are having difficulty we suggest you configure logging. Issues with the
+underlying kerberos libraries will be made apparent. Additionally, copious debug
+information is made available which may assist in troubleshooting if you
+increase your log level all the way up to debug.

+ 1 - 1
desktop/core/ext-py/requests-kerberos-0.12.0/requests_kerberos/__init__.py → desktop/core/ext-py/requests-kerberos-0.6.1/requests_kerberos/__init__.py

@@ -22,4 +22,4 @@ logging.getLogger(__name__).addHandler(NullHandler())
 
 __all__ = ('HTTPKerberosAuth', 'MutualAuthenticationError', 'REQUIRED',
            'OPTIONAL', 'DISABLED')
-__version__ = '0.12.0'
+__version__ = '0.6.1'

+ 0 - 0
desktop/core/ext-py/requests-kerberos-0.12.0/requests_kerberos/compat.py → desktop/core/ext-py/requests-kerberos-0.6.1/requests_kerberos/compat.py


+ 0 - 3
desktop/core/ext-py/requests-kerberos-0.12.0/requests_kerberos/exceptions.py → desktop/core/ext-py/requests-kerberos-0.6.1/requests_kerberos/exceptions.py

@@ -10,6 +10,3 @@ from requests.exceptions import RequestException
 
 class MutualAuthenticationError(RequestException):
     """Mutual Authentication Error"""
-
-class KerberosExchangeError(RequestException):
-    """Kerberos Exchange Failed Error"""

+ 3 - 18
desktop/core/ext-py/requests-kerberos-0.6.1/requests_kerberos/kerberos_.py

@@ -83,7 +83,6 @@ def _negotiate_value(response):
 class HTTPKerberosAuth(AuthBase):
     """Attaches HTTP GSSAPI/Kerberos Authentication to the given Request
     object."""
-
     def __init__(self, mutual_authentication=REQUIRED, service="HTTP"):
         self.context = {}
         self.mutual_authentication = mutual_authentication
@@ -104,7 +103,6 @@ class HTTPKerberosAuth(AuthBase):
                                          urlparse(response.url).port,
                                          threading.current_thread().ident)
 
-        log.debug("generate_request_header(): host_port_thread: {0}".format(host_port_thread))
         try:
             result, self.context[host_port_thread] = kerberos.authGSSClientInit(
                 "{0}@{1}".format(self.service, host))
@@ -133,7 +131,7 @@ class HTTPKerberosAuth(AuthBase):
             gss_response = kerberos.authGSSClientResponse(self.context[host_port_thread])
         except kerberos.GSSError:
             log.exception("generate_request_header(): authGSSClientResponse() "
-                          "failed:")
+                      "failed:")
             return None
 
         return "Negotiate {0}".format(gss_response)
@@ -234,24 +232,11 @@ class HTTPKerberosAuth(AuthBase):
                                          urlparse(response.url).port,
                                          threading.current_thread().ident)
 
-        log.debug("authenticate_server(): host_port_thread: {0}".format(host_port_thread))
         try:
             result = kerberos.authGSSClientStep(self.context[host_port_thread],
                                                 _negotiate_value(response))
-        except kerberos.GSSError as e:
-            # Since Isilon's webhdfs host and port will be the same for
-            # both 'NameNode' and 'DataNode' connections, Mutual Authentication will fail here
-            # due to the fact that a 307 redirect is made to the same host and port.
-            # host_port_thread will be the same when calling authGssClientStep().
-            # If we get a "Context is already fully established" response, that is OK if
-            # the response.url contains "datanode=true".  "datanode=true" is Isilon-specific
-            # in that it is not part of CDH.  It is an indicator to the Isilon server
-            # that the operation is a DataNode operation.
-
-            if 'datanode=true' in response.url and 'Context is already fully established' in e.args[1][0]:
-                log.debug("Caught Isilon mutual auth exception %s - %s" % (response.url, e.args[1][0]))
-                return True
-            log.exception("GSSError: authenticate_server(): authGSSClientStep() failed:")
+        except kerberos.GSSError:
+            log.exception("authenticate_server(): authGSSClientStep() failed:")
             return False
 
         if result < 1:

+ 2 - 0
desktop/core/ext-py/requests-kerberos-0.6.1/requirements.txt

@@ -0,0 +1,2 @@
+requests>=1.1.0
+kerberos==1.1.1

+ 1 - 0
desktop/core/ext-py/requests-kerberos-0.12.0/setup.cfg → desktop/core/ext-py/requests-kerberos-0.6.1/setup.cfg

@@ -4,4 +4,5 @@ universal = 1
 [egg_info]
 tag_build = 
 tag_date = 0
+tag_svn_revision = 0
 

+ 5 - 10
desktop/core/ext-py/requests-kerberos-0.12.0/setup.py → desktop/core/ext-py/requests-kerberos-0.6.1/setup.py

@@ -4,6 +4,9 @@ import os
 import re
 from setuptools import setup
 
+with open('requirements.txt') as requirements:
+    requires = [line.strip() for line in requirements if line.strip()]
+
 path = os.path.dirname(__file__)
 desc_fd = os.path.join(path, 'README.rst')
 hist_fd = os.path.join(path, 'HISTORY.rst')
@@ -26,7 +29,7 @@ def get_version():
     """
     reg = re.compile(r'__version__ = [\'"]([^\'"]*)[\'"]')
     with open('requests_kerberos/__init__.py') as fd:
-        matches = list(filter(lambda x: x, map(reg.match, fd)))
+        matches = filter(lambda x: x, map(reg.match, fd))
 
     if not matches:
         raise RuntimeError(
@@ -47,15 +50,7 @@ setup(
     package_data={'': ['LICENSE', 'AUTHORS']},
     include_package_data=True,
     version=get_version(),
-    install_requires=[
-        'requests>=1.1.0',
-        'cryptography>=1.3;python_version!="3.3"',
-        'cryptography>=1.3,<2;python_version=="3.3"'
-    ],
-    extras_require={
-        ':sys_platform=="win32"': ['winkerberos>=0.5.0'],
-        ':sys_platform!="win32"': ['pykerberos>=1.1.8,<2.0.0'],
-    },
+    install_requires=requires,
     test_suite='test_requests_kerberos',
     tests_require=['mock'],
 )