Current File : //usr/lib/python2.7/site-packages/salt/auth/pki.pyc
�
���^c @@ s� d Z d d l m Z m Z m Z d d l Z y� y d d l m Z e Z Wn[ e
k
r� e Z y d d l m
Z
Wn! e
k
r� d d l m
Z
n Xd d l Z n Xe Z Wn e
k
r� e Z n Xd d l Z e j e � Z d � Z d � Z d S( uz
Authenticate via a PKI certificate.
.. note::
This module is Experimental and should be used with caution
Provides an authenticate function that will allow the caller to authenticate
a user via their public cert against a pre-defined Certificate Authority.
TODO: Add a 'ca_dir' option to configure a directory of CA files, a la Apache.
:depends: - pyOpenSSL module
i ( t absolute_importt print_functiont unicode_literalsN( t X509( t asn1c C@ s t r
t St S( u/
Requires newer pycrypto and pyOpenSSL
( t HAS_DEPSt Truet False( ( ( s1 /usr/lib/python2.7/site-packages/salt/auth/pki.pyt __virtual__. s c K@ s? | } t d d � } t j d � t j d | � t j d | � t r� t j | t j � } t j | t j � } | j | j � � r� t j
d j | � � t St j
d j | � � t
Sn t j } | j | j | � } t j j j | � �" } | j | j | j � � } Wd QX| j � } | j | j | � }
t j � } | j |
� | d } | d
}
t j � } | j |
� | j } | d d k r�t d � � n | d
} y\ | j | | | | � t | j! � j" � � d | k s�t# d � � t j
d | � t SWn- t j j$ t# f k
r:t j
d | � n Xt
S( u�
Returns True if the given user cert (password is the cert contents)
was issued by the CA and if cert's Common Name is equal to username.
Returns False otherwise.
``username``: we need it to run the auth function from CLI/API;
it should be in master config auth/acl
``password``: contents of user certificate (pem-encoded user public key);
why "password"? For CLI, it's the only available name
Configure the CA cert in the master config file:
.. code-block:: yaml
external_auth:
pki:
ca_file: /etc/pki/tls/ca_certs/trusted-ca.crt
your_user:
- .*
u
config.getu external_auth:pki:ca_fileu# Attempting to authenticate via pki.u Using CA file: %su Certificate contents: %su+ Successfully authenticated certificate: {0}u' Failed to authenticate certificate: {0}Ni i u u Number of unused bits is strangei u CNu* Certificate's CN should match the usernameu* Successfully authenticated certificate: %su& Failed to authenticate certificate: %s(% t __salt__t logt debugt HAS_M2R t load_cert_stringt
FORMAT_PEMt load_certt verifyt
get_pubkeyt infot formatR R t OpenSSLt cryptot load_certificatet FILETYPE_PEMt saltt utilst filest fopent readt get_signature_algorithmt dump_certificatet
FILETYPE_ASN1R t DerSequencet decodet DerObjectt payloadt Exceptiont dictt get_subjectt get_componentst AssertionErrort Error( t usernamet passwordt kwargst pemt cacert_filet certt cacertt ct ft algot cert_asn1t dert der_certt der_sigt
der_sig_int sig0t sig( ( s1 /usr/lib/python2.7/site-packages/salt/auth/pki.pyt auth7 sJ
!
.( t __doc__t
__future__R R R t loggingt M2CryptoR R R t ImportErrorR t Cryptodome.UtilR t Crypto.UtilR R t salt.utils.filesR t getLoggert __name__R
R R; ( ( ( s1 /usr/lib/python2.7/site-packages/salt/auth/pki.pyt <module> s(
Mini Shell