mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2024-12-29 10:21:18 -06:00
893064f613
Some parts of install scripts used only ccache name as returned by krbV.CCache.name attribute. However, when this name is used again to initialize krbV.CCache object or when it is used in KRB5CCNAME environmental variable, it fails for new DIR type of CCACHE. We should always use both CCACHE type and name when referring to them to avoid these crashes. ldap2 backend was also updated to accept directly krbV.CCache object which contains everything we need to authenticate with ccache. https://fedorahosted.org/freeipa/ticket/3381
123 lines
3.8 KiB
Python
123 lines
3.8 KiB
Python
# Authors:
|
|
# Jason Gerard DeRose <jderose@redhat.com>
|
|
#
|
|
# Copyright (C) 2008 Red Hat
|
|
# see file 'COPYING' for use and warranty information
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
"""
|
|
Backend plugin for Kerberos.
|
|
|
|
This wraps the python-kerberos and python-krbV bindings.
|
|
"""
|
|
|
|
import sys
|
|
from ipalib import api
|
|
from ipalib.backend import Backend
|
|
import krbV
|
|
|
|
ENCODING = 'UTF-8'
|
|
|
|
|
|
class krb(Backend):
|
|
"""
|
|
Kerberos backend plugin.
|
|
|
|
This wraps the `krbV` bindings (and will eventually wrap the `kerberos`
|
|
bindings also). Importantly, this plugin does correct Unicode
|
|
encoding/decoding of values going-to/coming-from the bindings.
|
|
"""
|
|
|
|
def __default_ccache(self):
|
|
"""
|
|
Return the ``krbV.CCache`` for the default credential cache.
|
|
"""
|
|
return krbV.default_context().default_ccache()
|
|
|
|
def __default_principal(self):
|
|
"""
|
|
Return the ``krb5.Principal`` for the default credential cache.
|
|
"""
|
|
return self.__default_ccache().principal()
|
|
|
|
def __get_ccache(self, ccname):
|
|
"""
|
|
Return the ``krbV.CCache`` for the ``ccname`` credential ccache.
|
|
"""
|
|
return krbV.CCache(ccname)
|
|
|
|
def __get_principal(self, ccname):
|
|
"""
|
|
Return the ``krb5.Principal`` for the ``ccname`` credential ccache.
|
|
"""
|
|
return self.__get_ccache(ccname).principal()
|
|
|
|
def default_ccname(self):
|
|
"""
|
|
Return the default ccache file name (schema+name).
|
|
|
|
This will return something like 'FILE:/tmp/krb5cc_500'.
|
|
|
|
This cannot return anything meaningful if used in the server as a
|
|
request is processed.
|
|
"""
|
|
default_ccache = self.__default_ccache()
|
|
ccname = "%(type)s:%(name)s" % dict(type=default_ccache.type,
|
|
name=default_ccache.name)
|
|
return ccname
|
|
|
|
def default_principal(self):
|
|
"""
|
|
Return the principal name in default credential cache.
|
|
|
|
This will return something like 'admin@EXAMPLE.COM'. If no credential
|
|
cache exists for the invoking user, None is returned.
|
|
|
|
This cannot return anything meaningful if used in the server as a
|
|
request is processed.
|
|
"""
|
|
return self.__default_principal().name.decode(ENCODING)
|
|
|
|
def default_realm(self):
|
|
"""
|
|
Return the realm from the default credential cache.
|
|
|
|
This will return something like 'EXAMPLE.COM'. If no credential cache
|
|
exists for the invoking user, None is returned.
|
|
|
|
This cannot return anything meaningful if used in the server as a
|
|
request is processed.
|
|
"""
|
|
return krbV.default_context().default_realm.decode(ENCODING)
|
|
|
|
def get_principal(self, ccname):
|
|
"""
|
|
Return the principal from credential cache file at ``ccname``.
|
|
|
|
This will return something like 'admin@EXAMPLE.COM'.
|
|
"""
|
|
return self.__get_principal(ccname).name.decode(ENCODING)
|
|
|
|
def get_realm(self, ccname):
|
|
"""
|
|
Return the realm from credential cache file at ``ccname``.
|
|
|
|
This will return something like 'EXAMPLE.COM'.
|
|
"""
|
|
return self.__get_principal(ccname).realm.decode(ENCODING)
|
|
|
|
|
|
api.register(krb)
|