\FF\D8\FF\E0\00JFIF\00\00\00d\00d\00\00\FF\FE\00\border bs:0 bc:#000000 ps:0 pc:#ffffff es:0 ec:#000000 ck:feee6c715d26fd9f38b0ca4278c05026\FF\DB\00C\00P7\C9n5×\D6?\BDê\9Ds\EBp\9F[`8m\B7)o\B5\E8\E6I\99\FE3]]A2\BA\8Cw\D6E\93\\DEv\C8\009\F2\F1NI?uc\\F5\EA\96k\xN<~buv\EA\C8\D7 \8B\84\CEcxI\BBg\AE\9E=\D6+n\EC\80\C8A\8C\AE\EB\CF\D5\DA\E9"2\A4\B9j5\EB\F3W\B63\96\B30Yu\DA\FC8\ED\DF\E7Ms\FB\F1\8E\B3\FA\EA\E8\E6(\883zs\F2_\8DFk\8Bh \00\8C\DCw\D3R\B5+6X\BA\B2\C4j\AB0\B4\FCMw\C2I\8E\9B\E3\A9~9u\FA\D3l\80\C8%p\EE\FDn2€ \00 $\FEj\C4e\A9\DB\~\95\A7\A5\80EK\BB\8DDsP\00@@AD'k\CF\E8\DB\D2(\80\9AK\D3\85\D6lb\F2\BA\8C*\80\00)\95 59\A3R:\F3\CE"\B6\80\88\00\00i1u4ê\E9\F2á\A6\A2\FACM\93WMb*\E0*\00\00\00\00\00(\A8\80\00\00\80\00\00\00\00\00\00\00\00\00\FF\D9 C/// # Authors: John Dennis # # Copyright (C) 2012 Red Hat # see file 'COPYING' for use and warranty information # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation, either version 3 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see . import time import re import six import gssapi from ipalib import errors if six.PY3: unicode = str #------------------------------------------------------------------------------- # Kerberos error codes KRB5_CC_NOTFOUND = 2529639053 # Matching credential not found KRB5_FCC_NOFILE = 2529639107 # No credentials cache found KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN = 2529638918 # client not found in Kerberos db KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN = 2529638919 # Server not found in Kerberos database KRB5KRB_AP_ERR_TKT_EXPIRED = 2529638944 # Ticket expired KRB5_FCC_PERM = 2529639106 # Credentials cache permissions incorrect KRB5_CC_FORMAT = 2529639111 # Bad format in credentials cache KRB5_REALM_CANT_RESOLVE = 2529639132 # Cannot resolve network address for KDC in requested realm krb_ticket_expiration_threshold = 60*5 # number of seconds to accmodate clock skew krb5_time_fmt = '%m/%d/%y %H:%M:%S' ccache_name_re = re.compile(r'^((\w+):)?(.+)') #------------------------------------------------------------------------------- def krb5_parse_ccache(ccache_name): ''' Given a Kerberos ccache name parse it into it's scheme and location components. Currently valid values for the scheme are: * FILE * MEMORY The scheme is always returned as upper case. If the scheme does not exist it defaults to FILE. :parameters: ccache_name The name of the Kerberos ccache. :returns: A two-tuple of (scheme, ccache) ''' match = ccache_name_re.search(ccache_name) if match: scheme = match.group(2) location = match.group(3) if scheme is None: scheme = 'FILE' else: scheme = scheme.upper() return scheme, location else: raise ValueError('Invalid ccache name = "%s"' % ccache_name) def krb5_unparse_ccache(scheme, name): return '%s:%s' % (scheme.upper(), name) def krb5_format_service_principal_name(service, host, realm): ''' Given a Kerberos service principal name, the host where the service is running and a Kerberos realm return the Kerberos V5 service principal name. :parameters: service Service principal name. host The DNS name of the host where the service is located. realm The Kerberos realm the service exists in. :returns: Kerberos V5 service principal name. ''' return '%s/%s@%s' % (service, host, realm) def krb5_format_tgt_principal_name(realm): ''' Given a Kerberos realm return the Kerberos V5 TGT name. :parameters: realm The Kerberos realm the TGT exists in. :returns: Kerberos V5 TGT name. ''' return krb5_format_service_principal_name('krbtgt', realm, realm) def krb5_format_time(timestamp): ''' Given a UNIX timestamp format it into a string in the same manner the MIT Kerberos library does. Kerberos timestamps are always in local time. :parameters: timestamp Unix timestamp :returns: formated string ''' return time.strftime(krb5_time_fmt, time.localtime(timestamp)) def get_credentials(name=None, ccache_name=None): ''' Obtains GSSAPI credentials with given principal name from ccache. When no principal name specified, it retrieves the default one for given credentials cache. :parameters: name gssapi.Name object specifying principal or None for the default ccache_name string specifying Kerberos credentials cache name or None for the default :returns: gssapi.Credentials object ''' store = None if ccache_name: store = {'ccache': ccache_name} try: re