Файловый менеджер - Редактировать - /opt/imh-python/lib/python3.9/site-packages/keystoneauth1/extras/_saml2/v3/__pycache__/adfs.cpython-39.pyc
Ðазад
a s�h{Q � @ s� d dl Z d dlZd dlZd dlZzd dlmZ W n eyF dZY n0 d dlm Z d dlm Z d dl m Z d dlm Z G dd� de j�ZdS ) � N)�etree)�access)� exceptions)�base)�sessionc sX e Zd ZdZdZddiZddiZdddd �Zdd d �Zd Z d'd d d d d d d d ddd� e e e e e e e e j e e j e e j e e j e e j e e j e e j e e j e e j e e e d�� fdd�Zeje d�dd�Zd(e ee e f d�dd�Zd d�dd �Zejd d�d d �Zd d�d d �Zejd d�d!d"�Zejd d�d#d$�Zejejd�d%d&�Z� Z S ))�Passwordz1Authentication plugin for Microsoft ADFS2.0 IdPs.�x z Content-Typez#application/soap+xml; charset=utf-8z!application/x-www-form-urlencodedz'http://www.w3.org/2003/05/soap-envelope�$http://www.w3.org/2005/08/addressingzRhttp://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd)�s�a�u�0http://docs.oasis-open.org/ws-sx/ws-trust/200512)r �tzZ/s:Envelope/s:Body/t:RequestSecurityTokenResponseCollection/t:RequestSecurityTokenResponseNT) �trust_id� system_scope� domain_id� domain_name� project_id� project_name�project_domain_id�project_domain_name�reauthenticate�include_catalog)�auth_url�identity_provider�identity_provider_url�service_provider_endpoint�username�password�protocol�service_provider_entity_idr r r r r r r r r r c s< t � j||||||| | | | | |||||d� || _|| _dS )ap Constructor for ``ADFSPassword``. :param auth_url: URL of the Identity Service :type auth_url: string :param identity_provider: name of the Identity Provider the client will authenticate against. This parameter will be used to build a dynamic URL used to obtain unscoped OpenStack token. :type identity_provider: string :param identity_provider_url: An Identity Provider URL, where the SAML2 authentication request will be sent. :type identity_provider_url: string :param service_provider_endpoint: Endpoint where an assertion is being sent, for instance: ``https://host.domain/Shibboleth.sso/ADFS`` :type service_provider_endpoint: string :param service_provider_entity_id: Service Provider SAML Entity ID :type service_provider_entity_id: string :param username: User's login :type username: string :param password: User's password :type password: string )r r r r r r r r r r r r r r r r N)�super�__init__r r )�selfr r r r r r r r r r r r r r r r r r �� __class__� ��/root/rpmbuild/BUILDROOT/imh-python39-modules-3.9.7-92.el8.x86_64/opt/imh-python/lib/python3.9/site-packages/keystoneauth1/extras/_saml2/v3/adfs.pyr" : s( 2�zPassword.__init__)r �returnc C s t |jj�S )a Check if cookie jar is not empty. keystoneauth1.session.Session object doesn't have a cookies attribute. We should then try fetching cookies from the underlying requests.Session object. If that fails too, there is something wrong and let Python raise the AttributeError. :param session: A session object to extract cookies from :returns: True if cookie jar is nonempty, False otherwise :raises AttributeError: in case cookies are not find anywhere )�boolr �cookies�r# r r& r& r' �_cookies� s zPassword._cookies�%Y-%m-%dT%H:%M:%S.%fZ)�fmtr( c C s> t j �t jj�jdd�}|t j| jd� }|�|�|�|�fS )a� Calculate created and expires datetime objects. The method is going to be used for building ADFS Request Security Token message. Time interval between ``created`` and ``expires`` dates is now static and equals to 120 seconds. ADFS security tokens should not be live too long, as currently ``keystoneauth1`` doesn't have mechanisms for reusing such tokens (every time ADFS authn method is called, keystoneauth1 will login with the ADFS instance). :param fmt: Datetime format for specifying string format of a date. It should not be changed if the method is going to be used for building the ADFS security token request. :type fmt: string N)�tzinfo)�seconds)�datetime�now�timezone�utc�replace� timedelta� DEFAULT_ADFS_TOKEN_EXPIRATION�strftime)r# r. Z date_createdZ date_expiresr& r& r' � _token_dates� s ��zPassword._token_dates)r( c C s� ddi}ddi}ddi}ddi}t jd | jd �}t �|d �}t �|d �}|�d d� d|_t �|d�}dt�� j |_t �|d�} t �| d�} d| _t �|d�} | �d d� t j|d|d �} | �d d� t �| d�} | �dd� t �| d�}t �| d�}| � � \|_|_t �| d �}|�d d t�� j� d �� t �|d �}t j|d!d"d#�}t �|d$�}t j|d%|d �}t j|d&|d �}t j|d'|d �}t �|d�}t �|d(�}d)|_t �|d*�}d+|_t �|d,�}d-|_| j |_| j |_| j | _| j �p�| j|_|| _d.S )/z�Build the ADFS Request Security Token SOAP message. Some values like username or password are inserted in the request. �ozQhttp://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd�trustr Zwspz,http://schemas.xmlsoap.org/ws/2004/09/policyZwsar z1{http://www.w3.org/2003/05/soap-envelope}Envelope)Znsmapz/{http://www.w3.org/2003/05/soap-envelope}Headerz,{http://www.w3.org/2005/08/addressing}Actionz7{http://www.w3.org/2003/05/soap-envelope}mustUnderstand�1z:http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issuez/{http://www.w3.org/2005/08/addressing}MessageIDz urn:uuid:z-{http://www.w3.org/2005/08/addressing}ReplyToz-{http://www.w3.org/2005/08/addressing}Addressz.http://www.w3.org/2005/08/addressing/anonymousz({http://www.w3.org/2005/08/addressing}Toz[{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Securityz]{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}TimestampzV{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}IdZ_0z[{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Createdz[{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Expiresz`{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameTokenzU{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}uzuuid-z-1z[{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Usernamez[{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Passwordz_http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText)�Typez-{http://www.w3.org/2003/05/soap-envelope}BodyzF{http://docs.oasis-open.org/ws-sx/ws-trust/200512}RequestSecurityTokenz7{http://schemas.xmlsoap.org/ws/2004/09/policy}AppliesToz7{http://www.w3.org/2005/08/addressing}EndpointReferencez9{http://docs.oasis-open.org/ws-sx/ws-trust/200512}KeyTypez7http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearerz={http://docs.oasis-open.org/ws-sx/ws-trust/200512}RequestTypez6http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issuez;{http://docs.oasis-open.org/ws-sx/ws-trust/200512}TokenTypez%urn:oasis:names:tc:SAML:1.0:assertionN)r ZElement� NAMESPACESZ SubElement�set�text�uuid�uuid4�hexr9 r r r r r �prepared_request)r# ZWSS_SECURITY_NAMESPACEZTRUST_NAMESPACEZ WSP_NAMESPACEZ WSA_NAMESPACE�root�header�actionZ messageIDZreplyID�address�to�security� timestamp�created�expiresZ usernametokenr r �body�request_security_tokenZ applies_toZendpoint_referenceZ wsa_addressZkeytypeZ request_type� token_typer& r& r' �_prepare_adfs_request� s� ����������� ���������� �� �������� �z Password._prepare_adfs_requestc C s� | � | j�}z|j| j| j|dd�}W n� tjy� } zn|jdu rD� z.| �|jj �j d| j d�}| � |�}|j }W n ttjfy� |�Y n0 t�|��W Y d}~n d}~0 0 d}| �|j |�| _dS )ai Send ADFS Security token to the ADFS server. Store the result in the instance attribute and raise an exception in case the response is not valid XML data. If a user cannot authenticate due to providing bad credentials, the ADFS2.0 server will return a HTTP 500 response and a XML Fault message. If ``exceptions.InternalServerError`` is caught, the method tries to parse the XML response. If parsing is unsuccessful, an ``exceptions.AuthorizationFailure`` is raised with a reason from the XML fault. Otherwise an original ``exceptions.InternalServerError`` is re-raised. :param session : a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :raises keystoneauth1.exceptions.AuthorizationFailure: when HTTP response from the ADFS server is not a valid XML ADFS security token. :raises keystoneauth1.exceptions.InternalServerError: If response status code is HTTP 500 and the response XML cannot be recognized. F)�url�headers�data� authenticatedNz3/s:Envelope/s:Body/s:Fault/s:Code/s:Subcode/s:Value�� namespaceszFError parsing XML returned from the ADFS Identity Provider, reason: %s)� xml_to_strrD �postr � HEADER_SOAPr ZInternalServerError�responseZ str_to_xml�content�xpathr> �_firstr@ � IndexError�AuthorizationFailure� adfs_token)r# r rO r[ �e�obj�reason�msgr& r& r' �_get_adfs_security_tokenj s0 � � �z!Password._get_adfs_security_tokenc C sN | j j| j| jd�}| �|�}| �|�}|�dd�}tj� |�}d| | _ dS )a) Prepare ADFS Security Token to be sent to the Service Provider. The method works as follows: * Extract SAML2 assertion from the ADFS Security Token. * Replace namespaces * urlencode assertion * concatenate static string with the encoded assertion rV s0 http://docs.oasis-open.org/ws-sx/ws-trust/200512s+ http://schemas.xmlsoap.org/ws/2005/02/trustzwa=wsignin1.0&wresult=N) ra r] �ADFS_ASSERTION_XPATH�ADFS_TOKEN_NAMESPACESr^ rX r5 �urllib�parse�quote�encoded_assertion)r# Z assertionrl r& r& r' �_prepare_sp_request� s � � z Password._prepare_sp_requestc C s |j | j| j| jddd� dS )a Send prepared assertion to a service provider. As the assertion doesn't contain a protected resource, the value from the ``location`` header is not valid and we should not let the Session object get redirected there. The aim of this call is to get a cookie in the response which is required for entering a protected endpoint. :param session : a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :raises: Corresponding HTTP error exception F)rR rT rS �redirectrU N)rY r rl � HEADER_X_FORMr+ r& r& r' �#_send_assertion_to_service_provider� s �z,Password._send_assertion_to_service_providerc C s. | � |�du rt�d��|j| jdd�| _dS )a Access protected endpoint and fetch unscoped token. After federated authentication workflow a protected endpoint should be accessible with the session object. The access is granted basing on the cookies stored within the session object. If, for some reason no cookies are present (quantity test) it means something went wrong and user will not be able to fetch an unscoped token. In that case an ``exceptions.AuthorizationFailure` exception is raised and no HTTP call is even made. :param session : a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :raises keystoneauth1.exceptions.AuthorizationFailure: in case session object has empty cookie jar. FzwSession object doesn't contain a cookie, therefore you are not allowed to enter the Identity Provider's protected area.)rU N)r, r r` �getZfederated_token_url�authenticated_responser+ r& r& r' �_access_service_provider� s ��z!Password._access_service_providerc C sP | � � | �|� | �� | �|� | �|� tj| jd�}t|tj �sLJ �|S )aj Retrieve unscoped token after authentcation with ADFS server. This is a multistep process: * Prepare ADFS Request Securty Token - build an etree.XML object filling certain attributes with proper user credentials, created/expires dates (ticket is be valid for 120 seconds as currently we don't handle reusing ADFS issued security tokens). * Send ADFS Security token to the ADFS server. Step handled by * Receive and parse security token, extract actual SAML assertion and prepare a request addressed for the Service Provider endpoint. This also includes changing namespaces in the XML document. Step handled by ``ADFSPassword._prepare_sp_request()`` method. * Send prepared assertion to the Service Provider endpoint. Usually the server will respond with HTTP 301 code which should be ignored as the 'location' header doesn't contain protected area. The goal of this operation is fetching the session cookie which later allows for accessing protected URL endpoints. Step handed by ``ADFSPassword._send_assertion_to_service_provider()`` method. * Once the session cookie is issued, the protected endpoint can be accessed and an unscoped token can be retrieved. Step handled by ``ADFSPassword._access_service_provider()`` method. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :returns: AccessInfo :rtype: :py:class:`keystoneauth1.access.AccessInfo` )�resp) rQ rf rm rp rs r �createrr � isinstance� AccessInfoV3)r# r Z access_infor& r& r' �get_unscoped_auth_ref� s & z Password.get_unscoped_auth_ref)N)r- ) �__name__� __module__� __qualname__�__doc__r7 rZ ro r> rh rg �str�ty�Optionalr) r" � ks_session�Sessionr, �tupler9 rQ rf rm rp rs r rw rx � __classcell__r& r& r$ r' r s| � �� � ��H � � A< � �r )r1 �typingr~ ri rA Zlxmlr � ImportErrorZ keystoneauth1r r Z keystoneauth1.extras._saml2.v3r r r� ZBaseSAMLPluginr r& r& r& r' �<module> s
| ver. 1.1 | |
.
| PHP 8.3.30 | Ð“ÐµÐ½ÐµÑ€Ð°Ñ†Ð¸Ñ Ñтраницы: 0 |
proxy
|
phpinfo
|
ÐаÑтройка