HEX

File: //usr/lib/python3.9/site-packages/ipalib/__pycache__/kinit.cpython-39.pyc
a

}�f� �@s�ddlZddlZddlZddlZddlZddlmZddlmZddl	m
Z
ddlmZddl
mZddlmZe�e�ZdZd	edd
�deZdeZe�e�Ze�e�Zd
d�Zddd�Zddd�Zddd�Zddd�Zddd�ZdS) �N)�	Principal)�paths)�run)�PATTERN_GROUPUSER_NAME)�	krb_utils)�validate_hostnamez@?([a-zA-Z0-9.-]*)$�(����)z!([a-zA-Z0-9.-]+)/([a-zA-Z0-9.-]+)c
Cs�t|t�rt|�}nt|t�s&td��d|vr@d|vr@td��ntt�|�}|dur�t�|�}|durntd��nF|d}zt|�Wn0ty�}ztt|���WYd}~n
d}~00|S)NzInvalid principal: not a string�/� zInvalid principal: bad spacingzInvalid principal: cannot parse�)	�
isinstancer�str�RuntimeError�user_pattern�match�service_patternr�
ValueError)�	principalr�hostname�e�r�0/usr/lib/python3.9/site-packages/ipalib/kinit.py�validate_principals"






"r�cCs�t|�tjtjh}t�d||�d|i}|durFt�d|�||d<td|d�D�]^}tj�	d�}|durz|tjd<ntj�
dd��z�z`t�t
|�tjj�}	tj|	|dd	�}
t�d
||�|
WW|dur�|tjd<ntj�
dd�Stjj�y`}zV|j|v�r�t�d|||�||k�r8t�d|��t�d
�t�d�WYd}~n
d}~00W|du�rz|tjd<ntj�
dd�n&|du�r�|tjd<ntj�
dd�0dSdS)z�
    Given a ccache_path, keytab file and a principal kinit as that user.

    The optional parameter 'attempts' specifies how many times the credential
    initialization should be attempted in case of non-responsive KDC.
    z)Initializing principal %s using keytab %sZ
client_keytabNzusing ccache %sZccacher�KRB5_CONFIGZinitiate)�name�store�usagezAttempt %d/%d: successzAttempt %d/%d: failed: %sz'Maximum number of attempts (%d) reachedz#Waiting 5 seconds before next retry�)rrZKRB5KDC_ERR_SVC_UNAVAILABLEZKRB5_KDC_UNREACH�logger�debug�range�os�environ�get�pop�gssapi�NamerZNameTypeZkerberos_principalZCredentials�
exceptionsZGSSErrorZmin_code�time�sleep)rZkeytab�ccache_name�configZattemptsZerrors_to_retryrZattemptZ
old_configrZcredrrrr�kinit_keytab8sX����
�
"
�
r/cCsBddi}tj��D]\}}|�d�r|||<q|dur>||d<|S)zPCommon os.environ for kinit

    Passes KRB5* and GSS* envs like KRB5_TRACE
    �LC_ALL�C)ZKRB5ZGSSNr)r$r%�items�
startswith)r.�env�key�valuerrr�_run_envis

r7FcCs�t|�t�d|�tjg}|dur2|�d|g�|durTt�d|�|�d|g�|rf|�d|g�|r~t�d�|�d�|r�t�d	�|�d
�|�dt|�g�t|�}	t	|||	dd
d�}
|
j
r�t|
j��|
S)aY
    perform interactive kinit as principal using password. If using FAST for
    web-based authentication, use armor_ccache_path to specify http service
    ccache.

    :param principal: principal name
    :param password: user password
    :param ccache_name: location of ccache (default: default location)
    :param config: path to krb5.conf (default: default location)
    :param armor_ccache_name: armor ccache for FAST (-T)
    :param canonicalize: request principal canonicalization (-C)
    :param enterprise: use enterprise principal (-E)
    :param lifetime: request TGT lifetime (-l)
    z(Initializing principal %s using passwordN�-cz&Using armor ccache %s for FAST webauthz-Tz-lz%Requesting principal canonicalizationz-CzUsing enterprise principalz-E�--FT)�stdinr4�
raiseonerr�
capture_error)
rr!r"r�KINIT�extend�appendrr7r�
returncoderZerror_output)r�passwordr-r.Zarmor_ccache_nameZcanonicalizeZ
enterpriseZlifetime�argsr4�resultrrr�kinit_passwordws4�




�
rDcCsTt�d�t�}tjdd|g}|durD|D]}|�dd�|�g�q*t||ddd�S)	a�
    perform anonymous pkinit to obtain anonymous ticket to be used as armor
    for FAST.

    :param ccache_name: location of the armor ccache (required)
    :param pkinit_anchor: if not None, the location of PKINIT anchor file to
        use. Otherwise the value from Kerberos client library configuration is
        used

    :raises: CalledProcessError if the anonymous PKINIT fails
    zInitializing anonymous ccachez-nr8N�-XzX509_anchors=FILE:{}T)r4r;r<)r!r"r7rr=r>�formatr)r-�pkinit_anchorsr4rB�
pkinit_anchorrrr�kinit_armor�s
rIcCs�t|�t�d||�tjg}|dur4|�d|g�|durh|D]&}|�d�sRJ�|�dd|��g�q@|�dd|��g�|�dt|�g�t|�}t	||d	d
d
d�S)a�Perform kinit with X.509 identity (PKINIT)

    :param principal: principal name
    :param user_identity: X509_user_identity paramemter
    :param ccache_name: location of ccache (default: default location)
    :param config: path to krb5.conf (default: default location)
    :param pkinit_anchor: if not None, the PKINIT anchors to use. Otherwise
        the value from Kerberos client library configuration is used. Entries
        must be prefixed with FILE: or DIR:

    user identity example:
       FILE:filename[,keyfilename]
       PKCS12:filename
       PKCS11:...
       DIR:directoryname

    :raises: CalledProcessError if PKINIT fails
    z)Initializing principal %s using PKINIT %sNr8)zFILE:zDIR:zENV:rEz
X509_anchors=zX509_user_identity=r9�
T)r4r:r;r<)
rr!r"rr=r>r3rr7r)rZ
user_identityr-r.rGrBrHr4rrr�kinit_pkinit�s�rK)NNr)N)NNNFFN)N)NNN) Zloggingr$�rer+r(Zipapython.kerberosrZipaplatform.pathsrZipapython.ipautilrZipalib.constantsrZipalibrZipalib.utilrZ	getLogger�__name__r!Z
PATTERN_REALMZPATTERN_PRINCIPALZPATTERN_SERVICE�compilerrrr/r7rDrIrKrrrr�<module>s8



1
�
2
�