OwlCyberSecurity - MANAGER
Edit File: authkerb.pyc
� �t�ac @ sG d Z d d d d d d g Z d d l m Z d d l Z d d l m Z m Z m Z d d l m Z d d l m Z d d l m Z d d l m Z d d l m Z d e f d � � YZ d e j f d � � YZ d e f d � � YZ d e f d � � YZ d e f d � � YZ d e f d � � YZ d e f d � � YZ d S( sX Kerberos authentication module. This implements two authentication modes: 1. An alternative to password based BASIC authentication in which the BASIC credentials are verified against Kerberos. 2. The NEGOTIATE mechanism (as defined in http://www.ietf.org/rfc/rfc4559.txt) that implements full GSSAPI authentication. t BasicKerberosCredentialst BasicKerberosCredentialFactoryt BasicKerberosCredentialsCheckert NegotiateCredentialst NegotiateCredentialFactoryt NegotiateCredentialsCheckeri����( t implementsN( t checkerst credentialst error( t succeed( t responsecode( t ICredentialFactory( t IPrincipalCredentials( t Loggert KerberosCredentialFactoryBasec B s< e Z d Z e � Z e e � d d d d � Z d � Z RS( s= Code common to Kerberos-based credential factories. c C s� | r | r | s- | r' | r' | s- t � | s� y t j | | � } Wq� t j k r� } | j j d d | d �t d | d f � � q� Xn | j | � \ | _ | _ d S( s� @param principal: full Kerberos principal (e.g., 'HTTP/server.example.com@EXAMPLE.COM'). If C{None} then the type and hostname arguments are used instead. @type principal: str @param serviceType: service type for Kerberos (e.g., 'HTTP'). Must be C{None} if principal used. @type serviceType: str @param hostname: hostname for this server. Must be C{None} if principal used. @type hostname: str s getServerPrincipalDetails: {ex}t exi s! Authentication System Failure: %sN( t AssertionErrort kerberost getServerPrincipalDetailst KrbErrort logR t ValueErrort _splitPrincipalt servicet realm( t selft principalt serviceTypet hostnameR ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyt __init__< s - c C s� yJ | j d � } | d } | d j d � } | d j � } | d } Wn: t k r� | j j d d | �t d | f � � n Xd | | f } | } | | f S( Nt /i i t @s' Invalid Kerberos principal: {principal}R s= Authentication System Failure: Invalid Kerberos principal: %ss %s@%s( t splitt uppert IndexErrorR R R ( R R t splitst servicetypeR R ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR V s N( t __name__t __module__t __doc__R R R R t NoneR R ( ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR 4 s c B s e Z d Z d � Z RS( sQ A set of user/password credentials that checks itself against Kerberos. c C s, t j j | | | � | | _ | | _ d S( sR @param username: user name of user to authenticate @type username: str @param password: password for user being authenticated @type password: str @param service: service principal @type service: str @param hostname: realm @type hostname: str N( R t UsernamePasswordR R t default_realm( R t usernamet passwordR R ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR m s ( R& R' R( R ( ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR h s c B s8 e Z d Z d Z d d d d � Z d � Z d � Z RS( s� Authorizer for insecure Basic (base64-encoded plaintext) authentication. This form of authentication is insecure and should only be used when SSL is in effect. Right now we do not check for that. t basicc C s t t | � j | | | � d S( s� @param principal: full Kerberos principal (e.g., 'HTTP/server.example.com@EXAMPLE.COM'). If C{None} then the type and hostname arguments are used instead. @type principal: str @param serviceType: service type for Kerberos (e.g., 'HTTP'). Must be C{None} if principal used. @type serviceType: str @param hostname: hostname for this server. Must be C{None} if principal used. @type hostname: str N( t superR R ( R R R R ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR � s c C s t i | j d 6� S( NR ( R R ( R t _ignore_peer( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyt getChallenge� s c C s� y | d j d � } Wn t j d � � n X| j d d � } t | � d k r� t | d | d | j | j � } t | � St j d � � d S( Ns ===t base64s Invalid credentialst :i i i ( t decodeR t LoginFailedR! t lenR R R R ( R t responset requestt credst c( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR4 � s # N( R& R' R( t schemeR) R R1 R4 ( ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR � s c B s0 e Z e � Z e e j � e f Z d � Z RS( c C s� t | � } | j } t | t � r� y& t j | j | j | j | j � WnW t j k r� } | j j d d | d �t j d | j | d | d f � � q� Xt | j | j f � Sn t j d | j f � � d S( Ns {ex}R i s Bad credentials for: %s (%s: %s)i s Bad credentials for: %s( R R t isinstanceR R t checkPasswordR, R- R R+ t BasicAuthErrorR R t UnauthorizedLogint authnURIR t authnPrincipalt authzPrincipal( R R t pcredsR9 R ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyt requestAvatarId� s &+( R& R' R R R R t ICredentialsCheckerR t credentialInterfacesRD ( ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR � s c B s$ e Z d Z e e j � d � Z RS( sQ A set of user/password credentials that checks itself against Kerberos. c C s | | _ | | _ d S( N( R R, ( R R R, ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR � s ( R& R' R( R R t ICredentialsR ( ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR � s c B s8 e Z d Z d Z d d d d � Z d � Z d � Z RS( sX Authorizer for Negotiate authentication (http://www.ietf.org/rfc/rfc4559.txt). t negotiatec C s t t | � j | | | � d S( s� @param principal: full Kerberos principal (e.g., 'HTTP/server.example.com@EXAMPLE.COM'). If C{None} then the type and hostname arguments are used instead. @type principal: str @param serviceType: service type for Kerberos (e.g., 'HTTP'). Must be C{None} if principal used. @type serviceType: str @param hostname: hostname for this server. Must be C{None} if principal used. @type hostname: str N( R/ R R ( R R R R ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR � s c C s t i � S( N( R ( R R0 ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR1 � s c s� y t j d � \ } } Wnk t j k r� } | j j d d | d d d | d d �t j d | d d | d d f � � n Xy t j | | � Wn� t j k r} | j j d d | d d d | d d �t j | � t j d | d d | d d f � � nW t j k rk} | j j d d | d �t j | � t j d | d f � � n Xt j | � } y | j | � \ } } WnJ t k r�| j j d d | �t j | � t j d | f � � n X| j � | j j � k rA| j j d d | d | j �t j | � t j d | f � � n t j | � } t j | � } | } d } | j d � d k r�| j d d � } | d } | d } n | | j k r�| } n y t j | � Wnk t j k r?} | j j d d | d d d | d d �t j d | d d | d d f � � n Xd | j | f � � f d � } t | _ | j | � t t | | � � S( Nt s authGSSServerInit: {ex0}({ex1})t ex0i t ex1i s% Authentication System Failure: %s(%s)s authGSSServerStep: {ex0}(ex1)s Bad credentials: %s(%s)s authGSSServerStep: {ex}R s Bad credentials: %ss7 authGSSServerTargetName invalid target name: '{target}'t targets# Bad credentials: bad target name %ss@ authGSSServerTargetName mismatch got: '{got}' wanted: '{wanted}'t gott wanteds% Bad credentials: wrong target name %sR i����s authGSSServerClean: {ex0}({ex1})s$ Authentication System Failure %s(%s)s %s %sc s, | j t j k r( | j j d � � n | S( Ns www-authenticate( t codeR t UNAUTHORIZEDt headerst addRawHeader( R8 R7 ( t wwwauth( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyt responseFilterAddWWWAuthenticate' s ( R t authGSSServerInitt GSSErrorR R R5 t authGSSServerStept authGSSServerCleanR? R t authGSSServerTargetNameR R t lowerR t authGSSServerResponset authGSSServerUserNamet findR! R R; t Truet handleErrorst addResponseFilterR R ( R t base64dataR8 t _ignore_resultt contextR t targetnameR t _ignore_realmR7 R R, t realmnameR$ RT ( ( RS s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR4 � s\ ,-, , ,- N( R& R' R( R; R) R R1 R4 ( ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR � s c B s' e Z e e j � e f Z d � Z RS( c C sW t | � } | j } t | t � r: t | j | j f � St j d | j f � � d S( Ns Bad credentials for: %s( R R R< R R RA RB R R? R@ ( R R RC R9 ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyRD 9 s ( R& R' R R RE R RF RD ( ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyR 3 s ( R( t __all__t zope.interfaceR R t twisted.credR R R t twisted.internet.deferR t txweb2R t txweb2.auth.interfacesR t txweb2.dav.authR t twext.python.logR t objectR R* R R R R R R ( ( ( s) /opt/cpanel-ccs/twistedcaldav/authkerb.pyt <module> s* 4( b