1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
|
# Authors:
# Jason Gerard DeRose <jderose@redhat.com>
#
# Copyright (C) 2008 Red Hat
# see file 'COPYING' for use and warranty information
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License as
# published by the Free Software Foundation; version 2 only
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
"""
Backend plugin for Kerberos.
This wraps the python-kerberos and python-krbV bindings.
"""
import sys
from ipalib import api
from ipalib.backend import Backend
import krbV
# FIXME: Is it safe to assume the Kerberos library is using UTF-8 for the
# principal and realm? If not, how do we query the Kerberos library to find
# the encoding it's using?
ENCODING = 'UTF-8'
FS_ENCODING = (sys.getfilesystemencoding() or sys.getdefaultencoding())
class krb(Backend):
"""
Kerberos backend plugin.
This wraps the `krbV` bindings (and will eventually wrap the `kerberos`
bindings also). Importantly, this plugin does correct Unicode
encoding/decoding of values going-to/coming-from the bindings.
"""
def __default_ccache(self):
"""
Return the ``krbV.CCache`` for the default credential cache.
"""
return krbV.default_context().default_ccache()
def __default_principal(self):
"""
Return the ``krb5.Principal`` for the default credential cache.
"""
return self.__default_ccache().principal()
def __get_ccache(self, ccname):
"""
Return the ``krbV.CCache`` for the ``ccname`` credential ccache.
"""
return krbV.CCache(ccname.encode(FS_ENCODING))
def __get_principal(self, ccname):
"""
Return the ``krb5.Principal`` for the ``ccname`` credential ccache.
"""
return self.__get_ccache(ccname).principal()
def default_ccname(self):
"""
Return the default ccache file name.
This will return something like '/tmp/krb5cc_500'.
This cannot return anything meaningful if used in the server as a
request is processed.
"""
return self.__default_ccache().name.decode(FS_ENCODING)
def default_principal(self):
"""
Return the principal name in default credential cache.
This will return something like 'admin@EXAMPLE.COM'. If no credential
cache exists for the invoking user, None is returned.
This cannot return anything meaningful if used in the server as a
request is processed.
"""
return self.__default_principal().name.decode(ENCODING)
def default_realm(self):
"""
Return the realm from the default credential cache.
This will return something like 'EXAMPLE.COM'. If no credential cache
exists for the invoking user, None is returned.
This cannot return anything meaningful if used in the server as a
request is processed.
"""
return krbV.default_context().default_realm.decode(ENCODING)
def get_principal(self, ccname):
"""
Return the principal from credential cache file at ``ccname``.
This will return something like 'admin@EXAMPLE.COM'.
"""
return self.__get_principal(ccname).name.decode(ENCODING)
def get_realm(self, ccname):
"""
Return the realm from credential cache file at ``ccname``.
This will return something like 'EXAMPLE.COM'.
"""
return self.__get_principal(ccname).realm.decode(ENCODING)
api.register(krb)
|
