| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225 |
- ##
- # Copyright (c) 2006-2009 Apple Inc. All rights reserved.
- #
- # Licensed under the Apache License, Version 2.0 (the "License");
- # you may not use this file except in compliance with the License.
- # You may obtain a copy of the License at
- #
- # http://www.apache.org/licenses/LICENSE-2.0
- #
- # Unless required by applicable law or agreed to in writing, software
- # distributed under the License is distributed on an "AS IS" BASIS,
- # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- # See the License for the specific language governing permissions and
- # limitations under the License.
- ##
- """
- PyKerberos Function Description.
- """
- class KrbError(Exception):
- pass
- class BasicAuthError(KrbError):
- pass
- class GSSError(KrbError):
- pass
- def checkPassword(user, pswd, service, default_realm):
- """
- This function provides a simple way to verify that a user name and password match
- those normally used for Kerberos authentication. It does this by checking that the
- supplied user name and password can be used to get a ticket for the supplied service.
- If the user name does not contain a realm, then the default realm supplied is used.
-
- NB For this to work properly the Kerberos must be configured properly on this machine.
- That will likely mean ensuring that the edu.mit.Kerberos preference file has the correct
- realms and KDCs listed.
-
- @param user: a string containing the Kerberos user name. A realm may be
- included by appending an '@' followed by the realm string to the actual user id.
- If no realm is supplied, then the realm set in the default_realm argument will
- be used.
- @param pswd: a string containing the password for the user.
- @param service: a string containging the Kerberos service to check access for.
- This will be of the form 'sss/xx.yy.zz', where 'sss' is the service identifier
- (e.g., 'http', 'krbtgt'), and 'xx.yy.zz' is the hostname of the server.
- @param default_realm: a string containing the default realm to use if one is not
- supplied in the user argument. Note that Kerberos realms are normally all
- uppercase (e.g., 'EXAMPLE.COM').
- @return: True if authentication succeeds, False otherwise.
- """
- def changePassword(user, oldpswd, newpswd):
- """
- This function allows to change the user password on the KDC.
- @param user: a string containing the Kerberos user name. A realm may be
- included by appending an '@' followed by the realm string to the actual user id.
- If no realm is supplied, then the realm set in the default_realm argument will
- be used.
- @param oldpswd: a string containing the old (current) password for the user.
- @param newpswd: a string containging the new password for the user.
- @return: True if password changing succeeds, False otherwise.
- """
- def getServerPrincipalDetails(service, hostname):
- """
- This function returns the service principal for the server given a service type
- and hostname. Details are looked up via the /etc/keytab file.
-
- @param service: a string containing the Kerberos service type for the server.
- @param hostname: a string containing the hostname of the server.
- @return: a string containing the service principal.
- """
- """
- GSSAPI Function Result Codes:
-
- -1 : Error
- 0 : GSSAPI step continuation (only returned by 'Step' function)
- 1 : GSSAPI step complete, or function return OK
- """
- # Some useful result codes
- AUTH_GSS_CONTINUE = 0
- AUTH_GSS_COMPLETE = 1
-
- # Some useful gss flags
- GSS_C_DELEG_FLAG = 1
- GSS_C_MUTUAL_FLAG = 2
- GSS_C_REPLAY_FLAG = 4
- GSS_C_SEQUENCE_FLAG = 8
- GSS_C_CONF_FLAG = 16
- GSS_C_INTEG_FLAG = 32
- GSS_C_ANON_FLAG = 64
- GSS_C_PROT_READY_FLAG = 128
- GSS_C_TRANS_FLAG = 256
-
- def authGSSClientInit(service, gssflags=GSS_C_MUTUAL_FLAG|GSS_C_SEQUENCE_FLAG):
- """
- Initializes a context for GSSAPI client-side authentication with the given service principal.
- authGSSClientClean must be called after this function returns an OK result to dispose of
- the context once all GSSAPI operations are complete.
- @param service: a string containing the service principal in the form 'type@fqdn'
- (e.g. 'imap@mail.apple.com').
- @param gssflags: optional integer used to set GSS flags.
- (e.g. GSS_C_DELEG_FLAG|GSS_C_MUTUAL_FLAG|GSS_C_SEQUENCE_FLAG will allow
- for forwarding credentials to the remote host)
- @return: a tuple of (result, context) where result is the result code (see above) and
- context is an opaque value that will need to be passed to subsequent functions.
- """
- def authGSSClientClean(context):
- """
- Destroys the context for GSSAPI client-side authentication. After this call the context
- object is invalid and should not be used again.
- @param context: the context object returned from authGSSClientInit.
- @return: a result code (see above).
- """
- def authGSSClientStep(context, challenge):
- """
- Processes a single GSSAPI client-side step using the supplied server data.
- @param context: the context object returned from authGSSClientInit.
- @param challenge: a string containing the base64-encoded server data (which may be empty
- for the first step).
- @return: a result code (see above).
- """
- def authGSSClientResponse(context):
- """
- Get the client response from the last successful GSSAPI client-side step.
- @param context: the context object returned from authGSSClientInit.
- @return: a string containing the base64-encoded client data to be sent to the server.
- """
- def authGSSClientUserName(context):
- """
- Get the user name of the principal authenticated via the now complete GSSAPI client-side operations.
- This method must only be called after authGSSClientStep returns a complete response code.
- @param context: the context object returned from authGSSClientInit.
- @return: a string containing the user name.
- """
- def authGSSClientUnwrap(context, challenge):
- """
- Perform the client side GSSAPI unwrap step
-
- @param challenge: a string containing the base64-encoded server data.
- @return: a result code (see above)
- """
- def authGSSClientWrap(context, data, user=None):
- """
- Perform the client side GSSAPI wrap step.
-
- @param data:the result of the authGSSClientResponse after the authGSSClientUnwrap
- @param user: the user to authorize
- @return: a result code (see above)
- """
- def authGSSServerInit(service):
- """
- Initializes a context for GSSAPI server-side authentication with the given service principal.
- authGSSServerClean must be called after this function returns an OK result to dispose of
- the context once all GSSAPI operations are complete.
- @param service: a string containing the service principal in the form 'type@fqdn'
- (e.g. 'imap@mail.apple.com').
- @return: a tuple of (result, context) where result is the result code (see above) and
- context is an opaque value that will need to be passed to subsequent functions.
- """
- def authGSSServerClean(context):
- """
- Destroys the context for GSSAPI server-side authentication. After this call the context
- object is invalid and should not be used again.
- @param context: the context object returned from authGSSServerInit.
- @return: a result code (see above).
- """
- def authGSSServerStep(context, challenge):
- """
- Processes a single GSSAPI server-side step using the supplied client data.
- @param context: the context object returned from authGSSServerInit.
- @param challenge: a string containing the base64-encoded client data.
- @return: a result code (see above).
- """
- def authGSSServerResponse(context):
- """
- Get the server response from the last successful GSSAPI server-side step.
- @param context: the context object returned from authGSSServerInit.
- @return: a string containing the base64-encoded server data to be sent to the client.
- """
- def authGSSServerUserName(context):
- """
- Get the user name of the principal trying to authenticate to the server.
- This method must only be called after authGSSServerStep returns a complete or continue response code.
- @param context: the context object returned from authGSSServerInit.
- @return: a string containing the user name.
- """
- def authGSSServerTargetName(context):
- """
- Get the target name if the server did not supply its own credentials.
- This method must only be called after authGSSServerStep returns a complete or continue response code.
- @param context: the context object returned from authGSSServerInit.
- @return: a string containing the target name.
- """
|