Ñò
Ã#xPc @ sÉ d d k Z d d k Z d d k Z d d k Td Z d Z d Z d Z d Z d Z d Z
d
Z d Z d
Z
e i d ƒ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d e f d „ ƒ YZ d S( iÿÿÿÿN( t *i i:Ç–iÃ:Ç–i:Ç–i :Ç–iÂ:Ç–iÇ:Ç–iÜ:Ç–i< i s %m/%d/%y %H:%M:%Ss ^((\w+):)?(.+)c C sv t i | ƒ } | oL | i d ƒ } | i d ƒ } | d j o
d } n
| i ƒ } | | f St d | ƒ ‚ d S( s’
Given a Kerberos ccache name parse it into it's scheme and
location components. Currently valid values for the scheme
are:
* FILE
* MEMORY
The scheme is always returned as upper case. If the scheme
does not exist it defaults to FILE.
:parameters:
ccache_name
The name of the Kerberos ccache.
:returns:
A two-tuple of (scheme, ccache)
i i t FILEs Invalid ccache name = "%s"N( t ccache_name_ret searcht groupt Nonet uppert
ValueError( t ccache_namet matcht schemet location( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyt krb5_parse_ccache- s
c C s d | i ƒ | f S( Ns %s:%s( R ( R
t name( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyt krb5_unparse_ccacheL s c C s d | | f S( s
Given a Kerberos user principal name and a Kerberos realm
return the Kerberos V5 user principal name.
:parameters:
user
User principal name.
realm
The Kerberos realm the user exists in.
:returns:
Kerberos V5 user principal name.
s %s@%s( ( t usert realm( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyt krb5_format_principal_nameO s
c C s d | | | f S( s¥
Given a Kerberos service principal name, the host where the
service is running and a Kerberos realm return the Kerberos V5
service principal name.
:parameters:
service
Service principal name.
host
The DNS name of the host where the service is located.
realm
The Kerberos realm the service exists in.
:returns:
Kerberos V5 service principal name.
s %s/%s@%s( ( t servicet hostR ( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyt" krb5_format_service_principal_name^ s c C s t d | | ƒ S( s·
Given a Kerberos realm return the Kerberos V5 TGT name.
:parameters:
realm
The Kerberos realm the TGT exists in.
:returns:
Kerberos V5 TGT name.
t krbtgt( R ( R ( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyt krb5_format_tgt_principal_nameq s
c C s t i t t i | ƒ ƒ S( sý
Given a UNIX timestamp format it into a string in the same
manner the MIT Kerberos library does. Kerberos timestamps are
always in local time.
:parameters:
timestamp
Unix timestamp
:returns:
formated string
( t timet strftimet
krb5_time_fmtt localtime( t timestamp( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyt krb5_format_time} s t KRB5_CCachec B sV e Z d Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z
RS( sy
Kerberos stores a TGT (Ticket Granting Ticket) and the service
tickets bound to it in a ccache (credentials cache). ccaches are
bound to a Kerberos user principal. This class opens a Kerberos
ccache and allows one to manipulate it. Most useful is the
extraction of ticket entries (cred's) in the ccache and the
ability to examine their attributes.
c C s t i | t ƒ d | _ d | _ d | _ d | _ d | _ ya t i
ƒ | _ t | ƒ \ | _ | _ t i d t
| ƒ d | i ƒ | _ | i i ƒ | _ Wn_ t i j
oP } | i d } | i d } | t j o t d | | f ƒ ‚ q | ‚ n Xd S( sÂ
:parameters:
ccache
The name of a Kerberos ccache used to hold Kerberos tickets.
:returns:
`KRB5_CCache` object encapsulting the ccache.
R
t contexti i s "%s", ccache="%s"N( t log_mgrt
get_loggert TrueR R R
R
t ccachet principalt krbVt default_contextR t CCachet strt Krb5Errort argst KRB5_FCC_NOFILER ( t selfR" t et
error_codet message( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyt __init__• s" $
c C s d | i | i f S( s
A Kerberos ccache is identified by a name comprised of a
scheme and location component. This function returns that
canonical name. See `krb5_parse_ccache()`
:returns:
The name of ccache with it's scheme and location components.
s %s:%s( R
R
( R+ ( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyt
ccache_str± s
c C s d | i ƒ | i i f S( Ns cache="%s" principal="%s"( R0 R# R
( R+ ( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyt __str__½ s c
C s) t | t i ƒ o
| } nQ y t i t | ƒ | i ƒ } Wn. t j
o" } | i d | | ƒ | ‚ n X| i | d d d d d d d d f
} y | i i
| t ƒ } Wnu t i j
oL } | i
d } | t j o# t d | i | i ƒ f ƒ ‚ n | ‚ n t j
o } | ‚ n X| S( s>
Given a Kerberos principal return the krbV credentials
tuple describing the credential. If the principal does
not exist in the ccache a KeyError is raised.
:parameters:
principal
The Kerberos principal whose ticket is being retrieved.
The principal may be either a string formatted as a
Kerberos V5 principal or it may be a `krbV.Principal`
object.
:returns:
A krbV credentials tuple. If the principal is not in the
ccache a KeyError is raised.
s- could not create krbV principal from "%s", %si s( "%s" credential not found in "%s" ccacheN( i N( i i i i ( t
isinstanceR$ t PrincipalR' R t Exceptiont errorR# R R" t get_credentialst KRB5_GC_CACHEDR( R) t KRB5_CC_NOTFOUNDt KeyErrorR
R0 ( R+ R# t krbV_principalR, t creds_tuplet credR- ( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyR6 À s6
c C s/ t | t i ƒ o
| } nQ y t i t | ƒ | i ƒ } Wn. t j
o" } | i d | | ƒ | ‚ n Xyp | i | ƒ } | d \ } } } } | i d | i t
| ƒ t
| ƒ t
| ƒ t
| ƒ ƒ | | | | f SWnK t j
o } | ‚ n2 t j
o% } | i d | i | ƒ | ‚ n Xd S( sÀ
Given a Kerberos principal return the ticket timestamps if the
principal's ticket in the ccache is valid. If the principal
does not exist in the ccache a KeyError is raised.
The return credential time values are Unix timestamps in
localtime.
The returned timestamps are:
authtime
The time when the ticket was issued.
starttime
The time when the ticket becomes valid.
endtime
The time when the ticket expires.
renew_till
The time when the ticket becomes no longer renewable (if renewable).
:parameters:
principal
The Kerberos principal whose ticket is being validated.
The principal may be either a string formatted as a
Kerberos V5 principal or it may be a `krbV.Principal`
object.
:returns:
return authtime, starttime, endtime, renew_till
s- could not create krbV principal from "%s", %si sX get_credential_times: principal=%s, authtime=%s, starttime=%s, endtime=%s, renew_till=%ss6 get_credential_times failed, principal="%s" error="%s"N( R2 R$ R3 R' R R4 R5 R6 t debugR
R R9 ( R+ R# R: R, R< t authtimet starttimet endtimet
renew_till( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyt get_credential_timesñ s(
c C s™ y | i | ƒ \ } } } } WnC t j
o
} t St j
o" } | i d | | ƒ | ‚ n Xt i ƒ } | | j o t S| | j o t St S( s²
Given a Kerberos principal return a boolean indicating if the
principal's ticket in the ccache is valid. If the ticket is
not in the ccache False is returned. If the ticket
exists in the ccache it's validity is checked and returned.
:parameters:
principal
The Kerberos principal whose ticket is being validated.
The principal may be either a string formatted as a
Kerberos V5 principal or it may be a `krbV.Principal`
object.
:returns:
True if the principal's ticket exists and is valid. False if
the ticket does not exist or if the ticket is not valid.
s5 credential_is_valid failed, principal="%s" error="%s"( RB R9 t FalseR4 R5 R R! ( R+ R# R> R? R@ RA R, t now( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyt credential_is_valid) s
c C s… y1 t d | | ƒ } | i | ƒ } | o t SWn t j
o n Xy# t | ƒ } | i | ƒ } | SWn t j
o t SXd S( s$
Test to see if ldap service ticket or the TGT is valid.
:parameters:
host
ldap server
realm
kerberos realm
:returns:
True if either the ldap service ticket or the TGT is valid,
False otherwise.
t HTTPN( R RE R! R9 R RC ( R+ R R R# t valid( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyRG K s c C sô d } yQ t d | | ƒ } | i | ƒ \ } } } } | o t | | ƒ } n | } Wn t j
o n XyK t | ƒ } | i | ƒ \ } } } } | o t | | ƒ } n | } Wn t j
o n X| i d | i ƒ | t | ƒ ƒ | S( sö
Returns the minimum endtime for tickets of interest (ldap service or TGT).
:parameters:
host
ldap server
realm
kerberos realm
:returns:
UNIX timestamp value.
i RF s KRB5_CCache %s endtime=%s (%s)( R RB t minR9 R R= R0 R ( R+ R R t resultR# R> R? R@ RA ( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyR@ h s&
"( t __name__t
__module__t __doc__R/ R0 R1 R6 RB RE RG R@ ( ( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyR ‹ s 1 8 " i, ( R$ R t ret ipapython.ipa_log_managerR7 R8 R* t KRB5KDC_ERR_S_PRINCIPAL_UNKNOWNt KRB5KRB_AP_ERR_TKT_EXPIREDt
KRB5_FCC_PERMt KRB5_CC_FORMATt KRB5_REALM_CANT_RESOLVEt krb_ticket_expiration_thresholdR t compileR R R R R R R t objectR ( ( ( s4 /usr/lib/python2.6/site-packages/ipalib/krb_utils.pyt s*