File: //usr/lib/python3.6/site-packages/ipalib/install/__pycache__/kinit.cpython-36.opt-1.pyc
3
�
�ix � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlmZ d dl m
Z
d dl m Z d dl
mZ eje�ZdZdZd Zd
e dd� d e Zd
e Zeje�Zeje�Zdd� Zddd�Zddd�Z d dd�Z d dd�Z dS ) � )�absolute_importN)�paths)�run)�PATTERN_GROUPUSER_NAME)�validate_hostnamel �:�- l :�- z@?([a-zA-Z0-9.-]*)$�(� �)z!([a-zA-Z0-9.-]+)/([a-zA-Z0-9.-]+)c C s� t | t�std��d| kr,d| kr,td��nrtj| �}|d kr�tj| �}|d krZtd��nD|d }y t|� W n. tk
r� } ztt|���W Y d d }~X nX d S )Nz Invalid principal: not a string�/� z Invalid principal: bad spacingz Invalid principal: cannot parse� )�
isinstance�str� RuntimeError� user_pattern�match�service_patternr �
ValueError)� principalr Zhostname�e� r �/usr/lib/python3.6/kinit.py�validate_principal# s
r c C sR t | � tth}tjd| |� tjd|� �x td|d �D �] }tjjd�}|dk rb|tjd< ntjj dd� z�y<t
j | t
j j
�}||d�} t
j|| dd�}
tjd ||� |
S t
jjk
�r } zL| j|kr҂ tjd
||| � ||kr�tjd |� � tjd � tjd
� W Y dd} ~ X nX W d|dk �r8|tjd< ntjj dd� X dS W dS )z�
Given a ccache_path, keytab file and a principal kinit as that user.
The optional parameter 'attempts' specifies how many times the credential
initialization should be attempted in case of non-responsive KDC.
z)Initializing principal %s using keytab %szusing ccache %sr � KRB5_CONFIGN)ZccacheZ
client_keytabZinitiate)�name�storeZusagezAttempt %d/%d: successzAttempt %d/%d: failed: %sz'Maximum number of attempts (%d) reachedz#Waiting 5 seconds before next retry� )r �KRB5KDC_ERR_SVC_UNAVAILABLE�KRB5_KDC_UNREACH�logger�debug�range�os�environ�get�pop�gssapi�NameZNameTypeZkerberos_principalZ Credentials�
exceptionsZGSSErrorZmin_code�timeZsleep) r Zkeytab� ccache_name�configZattemptsZerrors_to_retryZattemptZ
old_configr r Zcredr r r r � kinit_keytab; s@
r, Fc C s� t | � tjd| � tjd|g}|dk rBtjd|� |jd|g� |rT|jd|g� |rltjd� |jd� |r�tjd � |jd
� |jd | g� d d
i} |dk r�|| d< t||| ddd�}
|
jr�t |
j
��dS )z�
perform interactive kinit as principal using password. If using FAST for
web-based authentication, use armor_ccache_path to specify http service
ccache.
z(Initializing principal %s using passwordz-cNz&Using armor ccache %s for FAST webauthz-Tz-lz%Requesting principal canonicalizationz-CzUsing enterprise principalz-Ez--�LC_ALL�Cr FT)�stdin�env�
raiseonerr�
capture_error) r r r r �KINIT�extend�appendr �
returncoder Z error_output) r Zpasswordr* r+ Zarmor_ccache_nameZ canonicalizeZ
enterpriseZlifetime�argsr0 �resultr r r �kinit_passwordh s.
r9 c C s^ t jd� ddi}tjdd| g}|dk rJx |D ]}|jddj|�g� q.W t||d d d
� dS ) a}
perform anonymous pkinit to obtain anonymous ticket to be used as armor
for FAST.
:param ccache_name: location of the armor ccache
:param pkinit_anchor: if not None, the location of PKINIT anchor file to
use. Otherwise the value from Kerberos client library configuration is
used
:raises: CalledProcessError if the anonymous PKINIT fails
z Initializing anonymous ccacher- r. z-nz-cNz-XzX509_anchors=FILE:{}T)r0 r1 r2 )r r r r3 r4 �formatr )r* �pkinit_anchorsr0 r7 �
pkinit_anchorr r r � kinit_armor� s
r= c C s� t | � tjd| |� ddi}|dk r.||d< tjd|g}|dk rdx |D ]}|jdd|� �g� qHW |jdd |� �g� |jd
| g� t||d d d d
� dS )aq Perform kinit with X.509 identity (PKINIT)
:param principal: principal name
:param user_identity: X509_user_identity paramemter
:param ccache_name: location of ccache
:param config: path to krb5.conf (default: default location)
:param pkinit_anchor: if not None, the PKINIT anchors to use. Otherwise
the value from Kerberos client library configuration is used. Entries
must be prefixed with FILE: or DIR:
user identity example:
FILE:filename[,keyfilename]
PKCS12:filename
PKCS11:...
DIR:directoryname
:raises: CalledProcessError if PKINIT fails
z)Initializing principal %s using PKINIT %sr- r. Nr z-cz-Xz
X509_anchors=zX509_user_identity=z--�
T)r0 r/ r1 r2 )r r r r r3 r4 r )r Z
user_identityr* r+ r; r0 r7 r< r r r � kinit_pkinit� s
r? ���)Nr )NNFFN)N)NN) Z
__future__r Zloggingr" �rer) r& Zipaplatform.pathsr Zipapython.ipautilr Zipalib.constantsr Z ipalib.utilr Z getLogger�__name__r r r Z
PATTERN_REALMZPATTERN_PRINCIPALZPATTERN_SERVICE�compiler r r r, r9 r= r? r r r r �<module> s2
-
&