Current File : //usr/lib/python2.7/site-packages/salt/auth/__init__.pyc
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
m Z d d l m
Z
d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z e j e � Z e d d d d d
d d d
d d d g � Z d e f d � � YZ! d e f d � � YZ" d e f d � � YZ# d e f d � � YZ$ d S( u�
Salt's pluggable authentication system
This system allows for authentication to be managed in a module pluggable way
so that any external authentication system can be used inside of Salt
i ( t absolute_importt print_functiont unicode_literalsN( t input( t sixu clientu cmdu eauthu funu gather_job_timeoutu kwargu matchu metadatau print_eventu rawu yield_pub_datat LoadAuthc B@ s� e Z d Z d d � Z d � Z d � Z d � Z d � Z d � Z d � Z
d � Z d � Z d
� Z
d � Z d � Z d
� Z d � Z d � Z d d � Z d e d � Z RS( uH
Wrap the authentication system to handle peripheral components
c C@ ss | | _ d | _ t j j | � | _ t j j | � | _ t j j | � | _ | pi t j
j j | � | _
d S( Ng �?( t optst max_failt saltt payloadt Serialt serialt loadert autht eauth_tokenst tokenst utilst minionst CkMinionst ckminions( t selfR R ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt __init__= s c C@ s d | k r d Sd j | d � } | | j k r6 d Sy0 t j j j | j | � d d } | | SWn t k
rz d SXd S( u�
Return the primary name associate with the load, if an empty string
is returned then the load does not match the function
u eauthu u {0}.authu argsi N( t formatR
R R t argst
arg_lookupt
IndexError( R t loadt fstrt pname_arg( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt load_nameE s $
c @ s� d | k r t Sd j | d � } | | j k r6 t Sd d d d g � � f d � | j � D� } t j j j | j | | d t �} yA d | k r� | j | | d | d � S| j | | d � SWn$ t k
r� } t
j d
| � t SXd S( u�
Return the token and set the cache data for use
Do not call this directly! Use the time_auth method to overcome timing
attacks
u eauthu {0}.authu usernameu passwordu tokenc @ s+ i | ]! \ } } | � k r | | � q S( ( ( t .0t keyt value( t _valid( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pys
<dictcomp>d s t expected_extra_kwsu kwargsu argsu Authentication module threw %sN( t FalseR R
t itemsR R R t format_callt AUTH_INTERNAL_KEYWORDSt Exceptiont logt debug( R R R t _loadt fcallt e( ( R! s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt __auth_callU s$
c C@ s� t j � } | j | � } | r% | St j � | } | | j k rP | | _ n | j d } t j � j | j | | j | � } x' | | t j � k r� t j d � q� Wt S( uO
Make sure that all failures happen in the same amount of time
i g����MbP?( t timet _LoadAuth__auth_callR t randomt SystemRandomt uniformt sleepR# ( R R t startt rett f_timet deviationt r_time( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt time_auths s
c C@ s� d | k r d S| j d } | s0 | d } n d j | � } | | j k rR d St j j j | j | | d t �} y | j | | d | d � SWn$ t k
r� } t
j d | � d SXd S( u�
Returns ACL for a specific user.
Returns None if eauth doesn't provide any for the user. I. e. None means: use acl declared
in master config.
u eauthu eauth_acl_moduleu {0}.aclR" u argsu kwargsu Authentication module threw %sN( t NoneR R R
R R R R% R& R' R( R) ( R R t modR R+ R, ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt __get_acl� s"
c C@ s| d | k r | Sd j | d � } | | j k r6 | Sy | j | | | j � SWn$ t k
rw } t j d | � | SXd S( u�
Allows eauth module to modify the access list right before it'll be applied to the request.
For example ldap auth module expands entries
u eauthu {0}.process_aclu Authentication module threw %sN( R R
R R' R( R) ( R R t auth_listR R, ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt
__process_acl� s c C@ s� d | k r t Sd j | d � } | | j k r6 t St j j j | j | | d t �} y | j | | d | d � SWn# t k
r� t St k
r� d SXd S( uw
Read in a load and return the groups a user is a member of
by asking the appropriate provider
u eauthu
{0}.groupsR" u argsu kwargsN( R# R R
R R R R% R& R R' R: ( R R R R+ ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt
get_groups� s
c C@ s� | j j d t � } | t k r% t St | t j � r~ | j | d g � } t | t j � r~ | j d � | k r{ t Sq~ n t S( uP
Return bool if requesting user is allowed to set custom expire
u token_expire_user_overrideu eauthu username( R t getR# t Truet
isinstancet collectionst Mappingt Iterable( R R t expire_overridet expire_whitelist( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt _allow_custom_expire� s
c C@ s | j | � s i S| j | � r> | j d | j d � } n | j d d � } | j d } i t j � d 6t j � | d 6| j | � d 6| d d 6} | j d r� | j | � } | | d <n | j | � } | r� | | d <n | j d j
| j d
� | j | � S( uM
Run time_auth and create a token. Return False or the token
u token_expireu startu expireu nameu eauthu keep_acl_in_tokenu auth_listu groupsu {0}.mk_tokenu eauth_tokensN( t authenticate_eauthRH t popR R: R. R t _LoadAuth__get_aclR? R R ( R R t token_expiret _t tdatat acl_rett groups( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt mk_token� s"
c C@ s� i } y- | j d j | j d � | j | � } Wn- t j j k
rb t j d | � t } n X| sm i St } | j
d d � t j � k r� t } n | r� | j | � n | S( ug
Return the name associated with the token, or False if the token is
not valid
u
{0}.get_tokenu eauth_tokensu5 Failed to load token %r - removing broken/empty file.u expirei (
R R R R t
exceptionst SaltDeserializationErrorR( t warningRA R# R@ R. t rm_token( R t tokRN t rm_tok( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt get_tok� s -
c C@ s$ | j d j | j d � | j � S( u8
List all tokens in eauth_tokn storage.
u {0}.list_tokensu eauth_tokens( R R R ( R ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt list_tokens
s c C@ s+ | j d j | j d � | j | � d S( u<
Remove the given token from token storage.
u {0}.rm_tokenu eauth_tokensN( R R R ( R RV ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyRU s c C@ sF | j | d � } | s1 | d | j d k rB t j d � t S| S( u~
Authenticate a user by the token specified in load.
Return the token object or False if auth failed.
u tokenu eauthu
external_authu0 Authentication failure of type "token" occurred.( RX R R( RT R# ( R R t token( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt authenticate_token s
c C@ s} d | k r t j d � t S| d | j d k rY t j d | d � t j d � t S| j | � sy t j d � t St S( u�
Authenticate a user by the external auth module specified in load.
Return True on success or False on failure.
u eauthu0 Authentication failure of type "eauth" occurred.u
external_authu$ The eauth system "%s" is not enabled( R( RT R# R R) R9 RA ( R R ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyRI ' s
c C@ s� d } | j d d � } | d k r5 t j | � t Sd | k r�t | d � } | j � r� | | | j j d d � k r� t j | � t S| j � S| d | j j d d � k s� | d d k r� | | | j j d d � k r�t j | � t Sq�| j
� r2| | j | d � k r�t j | � t Sq�| | j d � k rJq�| d | k r�| | | d k rt j | � t S| d St j | � t Sn- | | t j j
j � k r�t j | � t St S( u
Authenticate a user by the key passed in load.
Return the effective user id (name) if it's different from the specified one (for sudo).
If the effective user id is the same as the passed one, return True on success or False on
failure.
u/ Authentication failure of type "user" occurred.u keyu useru rootN( RJ R: R( RT R# t AuthUsert is_sudoR R@ t sudo_namet is_running_userR R t usert get_userRA ( R R R t error_msgt auth_keyt auth_user( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt authenticate_key= sB
/
c C@ sK | r' | j d r' d | k r' | d S| j | � } | d k rF | S| rV | d n | d } | | j d k r� t j d | � t j d � d S| r� | d } | j d � } n | j | � } | j | � } | j d | } | s� t j d | � n | s
g } n | j j
| | | � } | j | | � } t j d
| � | S( u�
Retrieve access list for the user specified in load.
The list is built by eauth module or from master eauth configuration.
Return None if current configuration doesn't provide any ACL for the user. Return an empty
list if the user has no rights to execute anything on this master and returns non-empty list
if user is allowed to execute particular functions.
u keep_acl_in_tokenu auth_listu eauthu
external_authu$ The eauth system "%s" is not enabledu Authorization failure occurred.u nameu groupsu! eauth "%s" configuration is emptyu Compiled auth_list: %sN(
R RK R: R( R) RT R@ R R? R t fill_auth_listt _LoadAuth__process_aclt trace( R R RZ R= t eautht nameRP t eauth_config( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt
get_auth_listl s6
c C@ s% g } | j d d � } i | d 6| d 6i d 6} | d k r� | j | � } | sp i d d 6d d 6| d <| S| d } | | d <| j | d
| �} n{| d k r� | j | � s� i d d 6d
j | � d 6| d <| S| j | � } n)| d k r�| j | | � } d }
| sO| r3d j |
| � }
n i d d 6|
d 6| d <| S| t k r�t | d � j � r�| j d s�| j d r�t } q�q�n | t k rd d l
} | j j j
| j d | � } | s�i d d 6|
d 6| d <| Sqn i d d 6d d 6| d <| S| | d <| S( u�
.. versionadded:: 2018.3.0
Go through various checks to see if the token/eauth/user can be authenticated.
Returns a dictionary containing the following keys:
- auth_list
- username
- error
If an error is encountered, return immediately with the relevant error dictionary
as authentication has failed. Otherwise, return the username and valid auth_list.
u usernameu UNKNOWNu auth_listu erroru tokenu TokenAuthenticationErroru nameu0 Authentication failure of type "token" occurred.u messageRZ u eauthu EauthAuthenticationErroru= Authentication failure of type "eauth" occurred for user {0}.u useru. Authentication failure of type "user" occurredu {0} for user {1}.u UserAuthenticationErroru sudo_aclu
publisher_acli Nu SaltInvocationErroru" Authentication type not supported.( R@ R[ Rl RI R Re RA R\ R] R t salt.utils.masterR t mastert get_values_of_matching_keys( R R t auth_typeR t
show_usernameR= t usernameR5 RZ t auth_rett msgR ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt check_authentication� sZ
N( t __name__t
__module__t __doc__R: R R R/ R9 RK Rg R? RH RQ RX RY RU R[ RI Re Rl R# Ru ( ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyR 9 s$ / 1t Authorizec B@ sP e Z d Z d d � Z e d � � Z d � Z d � Z d d � Z d � Z
RS( u0
The authorization engine used by EAUTH
c C@ s{ t j j j d d � t j j | d � | _ | | _ t j j j | � | _
| d k rn t | � | _
n | | _
d S( Nu Neonu� The 'Authorize' class has been deprecated. Please use the 'LoadAuth', 'Reslover', or 'AuthUser' classes instead. Support for the 'Authorze' class will be removed in Salt {version}.u conf_file( R R t versionst
warn_untilt configt
master_configR R R R R R: R t loadauth( R R R R~ ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyR � s c C@ s� | j d } | j d } d | k ro d | d k ro t j j j � } t j j j | | d d d | �} n d | k r� t j d t
� r� t j j j | d � | d <t
j | d � n | S(
u�
Gather and create the authorization data sets
We're looking at several constructs here.
Standard eauth: allow jsmith to auth via pam, and execute any command
on server web1
external_auth:
pam:
jsmith:
- web1:
- .*
Django eauth: Import the django library, dynamically load the Django
model called 'model'. That model returns a data structure that
matches the above for standard eauth. This is what determines
who can do what to which machines
django:
^model:
<stuff returned from django>
Active Directory Extended:
Users in the AD group 'webadmins' can run any command on server1
Users in the AD group 'webadmins' can run test.ping and service.restart
on machines that have a computer object in the AD 'webservers' OU
Users in the AD group 'webadmins' can run commands defined in the
custom attribute (custom attribute not implemented yet, this is for
future use)
ldap:
webadmins%: <all users in the AD 'webadmins' group>
- server1:
- .*
- ldap(OU=webservers,dc=int,dc=bigcompany,dc=com):
- test.ping
- service.restart
- ldap(OU=Domain Controllers,dc=int,dc=bigcompany,dc=com):
- allowed_fn_list_attribute^
u
external_authu pillar_merge_listsu djangou ^modelt strategyu listt merge_listsu ldapu auth.ldap.activedirectory( R R R
t djangot retrieve_auth_entriesR t
dictupdatet merget __opts__R@ R# t ldapt _Authorize__expand_ldap_entriesR( R) ( R t auth_dataR� t auth_from_django( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyR� � s *
c c@ s� y | j j | d � } Wn( t k
rD } t j d | � i Vn X| s` t j d � i Vn xx | D]p } x$ | D] } | d | k rt qt qt qt W| d | | d k d | | d k Bs� qg n i | d 6| d 6Vqg Wi Vd S( uF
Determine if token auth is valid and yield the adata
u tokenu1 Exception occurred when generating auth token: %su0 Authentication failure of type "token" occurred.u eauthu nameu *u sub_authN( R~ RX R' R( t errorRT ( R t adataR RZ t exct sub_autht sub_adata( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyRZ 9 s"
c c@ s� x� | g D]� } | d | k r& q
n yZ | j j | � } | | | d k d | | d k Bsg w
n | j j | � s w
n Wn& t k
r� } t j d | � q
n Xi | d 6| d 6Vq
Wi Vd S( uK
Determine if the given eauth is valid and yield the adata
u eauthu *u+ Exception occurred while authenticating: %su sub_authu nameN( R~ R R9 R' R( R� ( R R� R R� Rj R� ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyRi O s
c C@ s� | j d � r | | d } n | j j | | | k rB | | n | d | j d d
� | j d d
� | j d d
� | j d d � � } t | t � r� t S| s� | j d d � d k r� | Sn | S( uk
Read in the access system to determine if the validated user has
requested rights
u eauthu *u funu argu tgtu tgt_typeu globu u saltutil.find_jobN( R@ R t any_authR: RB t dictR# ( R t formR� Rj R Ri t good( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt rights_checkc s c C@ s | j } t } | j d t � r� xd | j | j | � D]M } | r7 | j | | j | d d | d d | | d d � r� t Sq7 q7 Wt j d � ns | j d � r xQ | j | j | � D]: } | r� | j | | d | d | | d � r� t Sq� q� Wt j d � n t S( u
Determine what type of authentication is being requested and pass
authorization
Note: this will check that the user has at least one right that will let
the user execute "load", this does not deal with conflicting rules
u tokenu eauthu nameu0 Authentication failure of type "token" occurred.u sub_authu0 Authentication failure of type "eauth" occurred.( R� R# R@ RZ R� RA R( RT Ri ( R R� R R� R� R� ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt rights� s6
N( Rv Rw Rx R: R t propertyR� RZ Ri R� R� ( ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyRy � s > t Resolverc B@ sD e Z d Z d � Z d � Z d � Z d � Z d � Z d � Z RS( uk
The class used to resolve options for the command line and for generic
interactive interfaces
c C@ s" | | _ t j j | � | _ d S( N( R R R R
( R R ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyR � s c C@ s� | j d d
k r d t j j j | j d � d t j | j d � } t j j j j
| j d d d
| �} | j | � S| j d d k r� t j j j j
| j � } d | _
| j | � Sd S( Nu transportu zeromqu tcpu tcp://u interfaceu :u ret_portt cryptu cleart
master_uriu raetu local_cmd( u zeromqu tcp( NNu local_cmd( R R R t zeromqt
ip_bracketR t text_typet transportt clientt
ReqChannelt factoryt sendR: t dst( R R R� t channel( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt _send_token_request� s 8
c C@ s� i } | s t d � | Sd j | � } | | j k rw t d j | � � t d j d j | j j j � � � � | St j j j | j | � } x| | d D]p } | | j
k r� | j
| | | <q� | j d � r� t j d j | � � | | <q� t
d j | � � | | <q� Wxc t | d j � � D]K \ } } | | j
k rX| j
| | d
<q)t
d j | | � � | | <q)Wd | k r�| d r�t j j j � | d <n | S(
uo
Execute the CLI options to fill in the extra data needed for the
defined eauth system
u5 External authentication system has not been specifiedu {0}.authuC The specified external authentication system "{0}" is not availableu Available eauth types: {0}u , u argsu passu {0}: u kwargsu kwargu {0} [{1}]: u username( t printR R
t joint file_mappingt keysR R R R R t
startswitht getpassR t listR$ R` Ra ( R Ri R5 R R t argt kwargt default( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt cli� s0
( # c C@ s� d | d <| | d <| j | � } d | k r3 | SyY t j j j d � �> t j j j | j d d � � } | j | d � Wd QXWd QXWn t t f k
r� n X| S( u�
Create the token from the CLI and request the correct data to
authenticate via the passed authentication mechanism
u mk_tokenu cmdu eauthu tokeni u
token_fileu w+N(
R� R R t filest set_umaskt fopenR t writet IOErrort OSError( R Ri R RN t fp_( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt token_cli� s
"!c C@ s d | d <| j | � } | S( u1
Request a token from the master
u mk_tokenu cmd( R� ( R R RN ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyRQ � s
c C@ s- i } | | d <d | d <| j | � } | S( u1
Request a token from the master
u tokenu get_tokenu cmd( R� ( R RZ R RN ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt get_token� s
( Rv Rw Rx R R� R� R� RQ R� ( ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyR� � s $ R\ c B@ s2 e Z d Z d � Z d � Z d � Z d � Z RS( uH
Represents a user requesting authentication to the salt master
c C@ s
| | _ d S( ua
Instantiate an AuthUser object.
Takes a user to reprsent, as a string.
N( R` ( R R` ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyR
s c C@ s | j j d � S( u�
Determines if the user is running with sudo
Returns True if the user is running with sudo and False if the
user is not running with sudo
u sudo_( R` R� ( R ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyR] s c C@ s | j t j j j � k S( u�
Determines if the user is the same user as the one running
this process
Returns True if the user is the same user as the one running
this process and False if not.
( R` R R Ra ( R ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyR_ s c C@ s | j j d d � d S( uh
Returns the username of the sudoer, i.e. self.user without the
'sudo_' prefix.
u _i i����( R` t split( R ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyR^ ( s ( Rv Rw Rx R R] R_ R^ ( ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyR\ s
(% Rx t
__future__R R R RC R. t loggingR0 R� t salt.ext.six.movesR t salt.extR t salt.configR t salt.exceptionst salt.loadert salt.payloadt salt.transport.clientt salt.utils.argst salt.utils.dictupdatet salt.utils.filest salt.utils.minionst salt.utils.usert salt.utils.versionst salt.utils.zeromqt getLoggerRv R( t frozensetR& t objectR Ry R� R\ ( ( ( s6 /usr/lib/python2.7/site-packages/salt/auth/__init__.pyt <module> sL
� ��`
Mini Shell