|
|
@@ -24,15 +24,8 @@ import urllib2 as u2
|
|
|
|
|
|
import kerberos as k
|
|
|
|
|
|
-def getLogger():
|
|
|
- log = logging.getLogger("http_kerberos_auth_handler")
|
|
|
- handler = logging.StreamHandler()
|
|
|
- formatter = logging.Formatter('%(asctime)s %(levelname)s %(message)s')
|
|
|
- handler.setFormatter(formatter)
|
|
|
- log.addHandler(handler)
|
|
|
- return log
|
|
|
|
|
|
-log = getLogger()
|
|
|
+LOG = logging.getLogger("http_kerberos_auth_handler")
|
|
|
|
|
|
class AbstractKerberosAuthHandler:
|
|
|
"""auth handler for urllib2 that does Kerberos HTTP Negotiate Authentication
|
|
|
@@ -49,10 +42,10 @@ class AbstractKerberosAuthHandler:
|
|
|
if mo:
|
|
|
return mo.group(1)
|
|
|
else:
|
|
|
- log.debug("regex failed on: %s" % authreq)
|
|
|
+ LOG.debug("regex failed on: %s" % authreq)
|
|
|
|
|
|
else:
|
|
|
- log.debug("%s header not found" % self.auth_header)
|
|
|
+ LOG.debug("%s header not found" % self.auth_header)
|
|
|
|
|
|
return None
|
|
|
|
|
|
@@ -62,39 +55,39 @@ class AbstractKerberosAuthHandler:
|
|
|
|
|
|
def generate_request_header(self, req, headers, neg_value):
|
|
|
self.retried += 1
|
|
|
- log.debug("retry count: %d" % self.retried)
|
|
|
+ LOG.debug("retry count: %d" % self.retried)
|
|
|
|
|
|
host = req.get_host()
|
|
|
- log.debug("req.get_host() returned %s" % host)
|
|
|
+ LOG.debug("req.get_host() returned %s" % host)
|
|
|
|
|
|
tail, sep, head = host.rpartition(':')
|
|
|
- domain = tail if tail else head
|
|
|
+ domain = tail or head
|
|
|
|
|
|
result, self.context = k.authGSSClientInit("HTTP@%s" % domain)
|
|
|
|
|
|
if result < 1:
|
|
|
- log.warning("authGSSClientInit returned result %d" % result)
|
|
|
+ LOG.warning("authGSSClientInit returned result %d" % result)
|
|
|
return None
|
|
|
|
|
|
- log.debug("authGSSClientInit() succeeded")
|
|
|
+ LOG.debug("authGSSClientInit() succeeded")
|
|
|
|
|
|
result = k.authGSSClientStep(self.context, neg_value)
|
|
|
|
|
|
if result < 0:
|
|
|
- log.warning("authGSSClientStep returned result %d" % result)
|
|
|
+ LOG.warning("authGSSClientStep returned result %d" % result)
|
|
|
return None
|
|
|
|
|
|
- log.debug("authGSSClientStep() succeeded")
|
|
|
+ LOG.debug("authGSSClientStep() succeeded")
|
|
|
|
|
|
response = k.authGSSClientResponse(self.context)
|
|
|
- log.debug("authGSSClientResponse() succeeded")
|
|
|
+ LOG.debug("authGSSClientResponse() succeeded")
|
|
|
|
|
|
return "Negotiate %s" % response
|
|
|
|
|
|
def authenticate_server(self, headers):
|
|
|
neg_value = self.negotiate_value(headers)
|
|
|
if neg_value is None:
|
|
|
- log.critical("mutual auth failed. No negotiate header")
|
|
|
+ LOG.critical("mutual auth failed. No negotiate header")
|
|
|
return None
|
|
|
|
|
|
result = k.authGSSClientStep(self.context, neg_value)
|
|
|
@@ -102,12 +95,12 @@ class AbstractKerberosAuthHandler:
|
|
|
if result < 1:
|
|
|
# this is a critical security warning
|
|
|
# should change to a raise --Tim
|
|
|
- log.critical("mutual auth failed: authGSSClientStep returned result %d" % result)
|
|
|
+ LOG.critical("mutual auth failed: authGSSClientStep returned result %d" % result)
|
|
|
pass
|
|
|
|
|
|
def clean_context(self):
|
|
|
if self.context is not None:
|
|
|
- log.debug("cleaning context")
|
|
|
+ LOG.debug("cleaning context")
|
|
|
k.authGSSClientClean(self.context)
|
|
|
self.context = None
|
|
|
|
|
|
@@ -123,22 +116,23 @@ class AbstractKerberosAuthHandler:
|
|
|
|
|
|
def retry_http_kerberos_auth(self, req, headers, neg_value):
|
|
|
try:
|
|
|
- neg_hdr = self.generate_request_header(req, headers, neg_value)
|
|
|
+ try:
|
|
|
+ neg_hdr = self.generate_request_header(req, headers, neg_value)
|
|
|
|
|
|
- if neg_hdr is None:
|
|
|
- log.debug("neg_hdr was None")
|
|
|
- return None
|
|
|
+ if neg_hdr is None:
|
|
|
+ LOG.debug("neg_hdr was None")
|
|
|
+ return None
|
|
|
|
|
|
- req.add_unredirected_header(self.authz_header, neg_hdr)
|
|
|
- resp = self.parent.open(req)
|
|
|
+ req.add_unredirected_header(self.authz_header, neg_hdr)
|
|
|
+ resp = self.parent.open(req)
|
|
|
|
|
|
- self.authenticate_server(resp.info())
|
|
|
+ self.authenticate_server(resp.info())
|
|
|
|
|
|
- return resp
|
|
|
+ return resp
|
|
|
|
|
|
- except k.GSSError, e:
|
|
|
- log.critical("GSSAPI Error: %s/%s" % (e[0][0], e[1][0]))
|
|
|
- return None
|
|
|
+ except k.GSSError, e:
|
|
|
+ LOG.critical("GSSAPI Error: %s/%s" % (e[0][0], e[1][0]))
|
|
|
+ return None
|
|
|
|
|
|
finally:
|
|
|
self.clean_context()
|
|
|
@@ -154,7 +148,7 @@ class ProxyKerberosAuthHandler(u2.BaseHandler, AbstractKerberosAuthHandler):
|
|
|
handler_order = 480 # before Digest auth
|
|
|
|
|
|
def http_error_407(self, req, fp, code, msg, headers):
|
|
|
- log.debug("inside http_error_407")
|
|
|
+ LOG.debug("inside http_error_407")
|
|
|
host = req.get_host()
|
|
|
retry = self.http_error_auth_reqed(host, req, headers)
|
|
|
self.retried = 0
|
|
|
@@ -170,15 +164,15 @@ class HTTPKerberosAuthHandler(u2.BaseHandler, AbstractKerberosAuthHandler):
|
|
|
handler_order = 480 # before Digest auth
|
|
|
|
|
|
def http_error_401(self, req, fp, code, msg, headers):
|
|
|
- log.debug("inside http_error_401")
|
|
|
+ LOG.debug("inside http_error_401")
|
|
|
host = req.get_host()
|
|
|
retry = self.http_error_auth_reqed(host, req, headers)
|
|
|
self.retried = 0
|
|
|
return retry
|
|
|
|
|
|
def test():
|
|
|
- log.setLevel(logging.DEBUG)
|
|
|
- log.info("starting test")
|
|
|
+ LOG.setLevel(logging.DEBUG)
|
|
|
+ LOG.info("starting test")
|
|
|
opener = u2.build_opener()
|
|
|
opener.add_handler(HTTPKerberosAuthHandler())
|
|
|
resp = opener.open(sys.argv[1])
|