Файловый менеджер - Редактировать - /opt/imh-python/lib/python3.9/site-packages/keystoneauth1/identity/v3/__pycache__/oidc.cpython-39.pyc
Ðазад
a s�ho� � @ s d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m Z d dl Z d dl mZ d dl mZ d dl mZ d dlmZ d dl mZ e�e�ZdZd Zejd d d �Z G d d � d ej e j d�Z G dd� de �Z G dd� de �Z!G dd� de �Z"G dd� de �Z#G dd� de �Z$dS )� N)�parse)�_utils)�access)� exceptions)� federation)�session)�OidcAuthorizationCode�OidcClientCredentials� OidcPassword�OidcAccessToken)�password�code�token�secret� _OidcBaseT� _OidcBase)�boundc sf e Zd ZU dZeje ed< eeeeeje eeeje eje eje eje eje eje eje eje eje eje e e d�� fdd� Z e j e eef d�dd�Ze j ed�d d �Ze eeje f e eeje f d �d d �Ze j e eeje f ed�dd�Ze j eejd�dd�Ze j ejd�dd�Zeje j e eeje f d�dd��Z� Z S )r z�Base class for different OpenID Connect based flows. The OpenID Connect specification can be found at:: ``http://openid.net/specs/openid-connect-core-1_0.html`` � grant_type��auth_url�identity_provider�protocol� client_id� client_secret�access_token_type�scope�access_token_endpoint�discovery_endpoint�trust_id� system_scope� domain_id� domain_name� project_id� project_name�project_domain_id�project_domain_name�reauthenticate�include_catalogc sT t � j|||| | | | ||||||d� || _|| _| | _i | _|| _|| _|| _dS )a� The OpenID Connect plugin expects the following. :param auth_url: URL of the Identity Service :type auth_url: string :param identity_provider: Name of the Identity Provider the client will authenticate against :type identity_provider: string :param protocol: Protocol name as configured in keystone :type protocol: string :param client_id: OAuth 2.0 Client ID :type client_id: string :param client_secret: OAuth 2.0 Client Secret :type client_secret: string :param access_token_type: OAuth 2.0 Authorization Server Introspection token type, it is used to decide which type of token will be used when processing token introspection. Valid values are: "access_token" or "id_token" :type access_token_type: string :param access_token_endpoint: OpenID Connect Provider Token Endpoint, for example: https://localhost:8020/oidc/OP/token Note that if a discovery document is provided this value will override the discovered one. :type access_token_endpoint: string :param discovery_endpoint: OpenID Connect Discovery Document URL, for example: https://localhost:8020/oidc/.well-known/openid-configuration :type access_token_endpoint: string :param scope: OpenID Connect scope that is requested from OP, for example: "openid profile email", defaults to "openid profile". Note that OpenID Connect specification states that "openid" must be always specified. :type scope: string ) r r r r r r r! r" r# r$ r% r& r' N) �super�__init__r r r �_discovery_documentr r r ��selfr r r r r r r r r r r r r! r" r# r$ r% r& r' �� __class__� ��/root/rpmbuild/BUILDROOT/imh-python39-modules-3.9.7-92.el8.x86_64/opt/imh-python/lib/python3.9/site-packages/keystoneauth1/identity/v3/oidc.pyr) 7 s, C�z_OidcBase.__init__�r �returnc C s� | j dur~| js~z|j| j dd�}W n( tjyL t�d| j � �� � Y n0 z|�� | _W n tyn Y n0 | js~t� � �| jS )a� Get the contents of the OpenID Connect Discovery Document. This method grabs the contents of the OpenID Connect Discovery Document if a discovery_endpoint was passed to the constructor and returns it as a dict, otherwise returns an empty dict. Note that it will fetch the discovery document only once, so subsequent calls to this method will return the cached result, if any. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :returns: a python dictionary containing the discovery document if any, otherwise it will return an empty dict. :rtype: dict NF)� authenticatedz Cannot fetch discovery document ) r r* �getr Z HttpError�_logger�error�json� ExceptionZ InvalidOidcDiscoveryDocument)r, r �respr/ r/ r0 �_get_discovery_document� s( ��� � z!_OidcBase._get_discovery_documentc C s@ | j dur| j S | �|�}|�d�}|du r4t�� �t�t|�S )ap Get the "token_endpoint" for the OpenID Connect flow. This method will return the correct access token endpoint to be used. If the user has explicitly passed an access_token_endpoint to the constructor that will be returned. If there is no explicit endpoint and a discovery url is provided, it will try to get it from the discovery document. If nothing is found, an exception will be raised. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :return: the endpoint to use :rtype: string NZtoken_endpoint)r r: r4 r Z OidcAccessTokenEndpointNotFound�ty�cast�str�r, r � discoveryZendpointr/ r/ r0 �_get_access_token_endpoint� s z$_OidcBase._get_access_token_endpoint)�datar2 c s6 t �|�}|D ]"� t� fdd�tD ��rd|� < q|S )Nc 3 s | ]}|� v V qd S )Nr/ )�.0�s��keyr/ r0 � <genexpr>� � z&_OidcBase._sanitize.<locals>.<genexpr>z***)�copy�deepcopy�any�SENSITIVE_KEYS)r, rA Z sanitizedr/ rD r0 � _sanitize� s z_OidcBase._sanitize�r �payloadr2 c C s� | j r| j| j f}nd}|�d| j� | �|�}t�tj�rT| �|�}t� d||� |j |||ddd�}|� � }t�tj�r�| �|�}t� d||� || j } t | t�s�J �| S )a Exchange a variety of user supplied values for an access token. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :param payload: a dict containing various OpenID Connect values, for example:: { 'grant_type': 'password', 'username': self.username, 'password': self.password, 'scope': self.scope, } :type payload: dict Nr �?Making OpenID-Connect authentication request to %s with data %sF)� requests_authrA �logr3 �4OpenID-Connect authentication response from %s is %s)r r � setdefaultr@ r5 � isEnabledFor�logging�DEBUGrL �debug�postr7 r � isinstancer= ) r, r rN � client_authr �sanitized_payload� op_response�response�sanitized_response� access_tokenr/ r/ r0 �_get_access_token� s< �� � z_OidcBase._get_access_token)r r_ r2 c C s" dd| i}|j | j|dd�}|S )a Exchange an access token for a keystone token. By Sending the access token in an `Authorization: Bearer` header, to an OpenID Connect protected endpoint (Federated Token URL). The OpenID Connect server will use the access token to look up information about the authenticated user (this technique is called instrospection). The output of the instrospection will be an OpenID Connect Claim, that will be used against the mapping engine. Should the mapping engine succeed, a Keystone token will be presented to the user. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :param access_token: The OpenID Connect access token. :type access_token: str � AuthorizationzBearer F)�headersr3 )rX Zfederated_token_url)r, r r_ rb Z auth_responser/ r/ r0 �_get_keystone_token s �z _OidcBase._get_keystone_tokenc C s� | � |�}t�tjtt |�d��}|rF| jdurF| j|vrFt� � �| � |�}|� d| j� | � ||�}| � ||�}tj|d�}t|tj�s�J �|S )a$ Authenticate with OpenID Connect and get back claims. This is a multi-step process: 1.- An access token must be retrieved from the server. In order to do so, we need to exchange an authorization grant or refresh token with the token endpoint in order to obtain an access token. The authorization grant varies from plugin to plugin. 2.- We then exchange the access token upon accessing the protected Keystone endpoint (federated auth URL). This will trigger the OpenID Connect Provider to perform a user introspection and retrieve information (specified in the scope) about the user in the form of an OpenID Connect Claim. These claims will be sent to Keystone in the form of environment variables. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :returns: a token data representation :rtype: :py:class:`keystoneauth1.access.AccessInfoV3` Zgrant_types_supportedNr �r9 )r: r; r< �Optional�listr= r4 r r ZOidcPluginNotSupported� get_payloadrS r` rc r �createrY � AccessInfoV3)r, r r? Z grant_typesrN r_ r] � access_infor/ r/ r0 �get_unscoped_auth_ref/ s$ ���� z _OidcBase.get_unscoped_auth_refc C s t � �dS )a$ Get the plugin specific payload for obtainin an access token. OpenID Connect supports different grant types. This method should prepare the payload that needs to be exchanged with the server in order to get an access token for the particular grant type that the plugin is implementing. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :returns: a python dictionary containing the payload to be exchanged :rtype: dict N)�NotImplementedError�r, r r/ r/ r0 rg b s z_OidcBase.get_payload) �__name__� __module__� __qualname__�__doc__r; �ClassVarr= �__annotations__re �boolr) � ks_session�Session�dict�objectr: r@ rL r` �requests�Responserc r ri rk �abc�abstractmethodrg � __classcell__r/ r/ r- r0 r . sT �^ � *� � 7� � 3�)� metaclassc s� e Zd ZdZdZdddddddddddd� eeeeeeeeje eje eje eje eje eje eje eje eje eje eje eje eje eed�� fd d �Z e j e eeje f d �d d �Z e eeje f e j dd�dd�Z� ZS )r zEImplementation for OpenID Connect Resource Owner Password Credential.r r_ �openid profileNT� r r r r! r" r# r$ r% r& r' )r r r r r r r r r �usernamer � idp_otp_keyr r r r! r" r# r$ r% r& r' c sH t � j||||||||| | |||||||||d� | | _| | _| | _dS )z�The OpenID Password plugin expects the following. :param username: Username used to authenticate :type username: string :param password: Password used to authenticate :type password: string r N)r( r) r� r r� )r, r r r r r r r r r r� r r� r r r r! r" r# r$ r% r& r' r- r/ r0 r) { s0 "�zOidcPassword.__init__r1 c C s& | j | j| j| jd�}| �||� |S )a Get an authorization grant for the "password" grant type. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :returns: a python dictionary containing the payload to be exchanged :rtype: dict )r� r r r )r� r r r �.manage_otp_from_session_or_request_to_the_user�r, r rN r/ r/ r0 rg � s � zOidcPassword.get_payload)rN r r2 c C sJ | j s dS t|dd�}|r&||| j < n td�|| j < t|d|| j � dS )a_ Get the OTP code from the session or else request to the user. When the OS_IDP_OTP_KEY environment variable is set, this method will verify if there is an OTP value in the current session, if it exists, we use it (the OTP from session) to send to the Identity Provider when retrieving the access token. If there is no OTP in the current session, we ask the user to enter it (the OTP), and we add it to the session to execute the authentication flow. The OTP is being stored in the session because in some flows, the CLI is doing the authentication process two times, so saving the OTP in the session, allow us to use the same OTP in a short time interval, avoiding to request it to the user twice in a row. :param payload: :param session: :return: NZotpz&Please, enter the generated OTP code: )r� �getattr�input�setattr)r, rN r Zotp_from_sessionr/ r/ r0 r� � s � z;OidcPassword.manage_otp_from_session_or_request_to_the_user)r_ r NNNNN)rn ro rp rq r r= r; re rt r) ru rv rw rg r� r} r/ r/ r- r0 r v sd ���<� �r c s� e Zd ZdZdZdddddddddddd� eeeeeeeeje eje eje eje eje eje eje eje eje eje eed�� fd d �Z e j e eeje f d �d d �Z � ZS )r z5Implementation for OpenID Connect Client Credentials.Zclient_credentialsr_ r NTr� r c s6 t � j||||||||| | | | | ||||||d� dS )z�The OpenID Client Credentials expects the following. :param client_id: Client ID used to authenticate :type username: string :param client_secret: Client Secret used to authenticate :type password: string r N)r( r) r+ r- r/ r0 r) � s* �z OidcClientCredentials.__init__r1 c C s d| j i}|S )a' Get an authorization grant for the client credentials grant type. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :returns: a python dictionary containing the payload to be exchanged :rtype: dict r )r r� r/ r/ r0 rg ( s z!OidcClientCredentials.get_payload)r_ r NN�rn ro rp rq r r= r; re rt r) ru rv rw rg r} r/ r/ r- r0 r � sR � ��6�r c s� e Zd ZdZdZddddddddddddd� eeeeeeeeje eje eje eje eje eje eje eje eje eje eje eeeje d�� fd d �Z e j e eeje f d �d d �Z � ZS )r z5Implementation for OpenID Connect Authorization Code.Zauthorization_coder_ r NT) r r r r! r" r# r$ r% r& r' � redirect_uri)r r r r r r r r r r r r r r! r" r# r$ r% r& r' r� c sB t � j||||||||| | | | |||||||d� || _| | _dS )z�The OpenID Authorization Code plugin expects the following. :param redirect_uri: OpenID Connect Client Redirect URL :type redirect_uri: string :param code: OAuth 2.0 Authorization Code :type code: string r N)r( r) r� r )r, r r r r r r r r r r r r r r! r" r# r$ r% r& r' r� r- r/ r0 r) < s. "�z OidcAuthorizationCode.__init__r1 c C s | j | jd�}|S )a) Get an authorization grant for the "authorization_code" grant type. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :returns: a python dictionary containing the payload to be exchanged :rtype: dict �r� r r� r� r/ r/ r0 rg v s z!OidcAuthorizationCode.get_payload)r_ r NNNr� r/ r/ r- r0 r 7 sZ � ��;�r c s� e Zd ZdZdddddddddddd� eeeeeeje eje eje eje eje eje eje eje eje eje eje eed�� fdd �Ze j e eeje f d �d d �Z e j e jd �d d�Z� ZS )r z5Implementation for OpenID Connect access token reuse.r_ r NTr� )r r r r r r r r_ r r r r! r" r# r$ r% r& r' c sH t � j|||dd||||| | | | | |||||d� |dus>J �|| _dS )a# The OpenID Connect plugin based on the Access Token. It expects the following: :param auth_url: URL of the Identity Service :type auth_url: string :param identity_provider: Name of the Identity Provider the client will authenticate against :type identity_provider: string :param protocol: Protocol name as configured in keystone :type protocol: string :param access_token: OpenID Connect Access token :type access_token: string � r N)r( r) r_ )r, r r r r r r r r_ r r r r! r" r# r$ r% r& r' r- r/ r0 r) � s. )� zOidcAccessToken.__init__r1 c C s i S )z+OidcAccessToken does not require a payload.r/ rm r/ r/ r0 rg � s zOidcAccessToken.get_payloadc C s. | � || j�}tj|d�}t|tj�s*J �|S )a� Authenticate with OpenID Connect and get back claims. We exchange the access token upon accessing the protected Keystone endpoint (federated auth URL). This will trigger the OpenID Connect Provider to perform a user introspection and retrieve information (specified in the scope) about the user in the form of an OpenID Connect Claim. These claims will be sent to Keystone in the form of environment variables. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :returns: a token data representation :rtype: :py:class:`keystoneauth1.access.AccessInfoV3` rd )rc r_ r rh rY ri )r, r r] rj r/ r/ r0 rk � s z%OidcAccessToken.get_unscoped_auth_ref)r_ r NNN)rn ro rp rq r= r; re rt r) ru rv rw rg r ri rk r} r/ r/ r- r0 r � sV � ��D� �r c sD e Zd ZdZdZddiZdddddddddddd� eeeeeje eeje eje eje eje eje eje eje eje eje eje eje eje eje e e d �� fd d �Z e j eje d �d d�Z ed�dd�Zeje d�dd�Ze j eeeje f d �dd�Ze j eeeje f ed�dd�Z� ZS )�OidcDeviceAuthorizationz8Implementation for OAuth 2.0 Device Authorization Grant.z,urn:ietf:params:oauth:grant-type:device_codez Content-Typez!application/x-www-form-urlencodedr NTr� )r r r r r r r r � device_authorization_endpoint�code_challenge�code_challenge_methodr r r r! r" r# r$ r% r& r' c sJ d| _ | | _| | _t� j|||||| j |||| | ||||||||d� dS )a� The OAuth 2.0 Device Authorization plugin expects the following. :param device_authorization_endpoint: OAuth 2.0 Device Authorization Endpoint, for example: https://localhost:8020/oidc/authorize/device Note that if a discovery document is provided this value will override the discovered one. :type device_authorization_endpoint: string :param code_challenge_method: PKCE Challenge Method (RFC 7636). :type code_challenge_method: string r_ r N)r r� r� r( r) )r, r r r r r r r r r� r� r� r r r r! r" r# r$ r% r& r' r- r/ r0 r) � s0 (�z OidcDeviceAuthorization.__init__r1 c C sB | j dur| j S | �|�}|�d�}|du r6tj�� �t�t|�S )a� Get the endpoint for the OAuth 2.0 Device Authorization flow. This method will return the correct device authorization endpoint to be used. If the user has explicitly passed an device_authorization_endpoint to the constructor that will be returned. If there is no explicit endpoint and a discovery url is provided, it will try to get it from the discovery document. If nothing is found, an exception will be raised. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :return: the endpoint to use :rtype: string or None if no endpoint is found Nr� ) r� r: r4 r �oidcZ'OidcDeviceAuthorizationEndpointNotFoundr; r< r= r> r/ r/ r0 �"_get_device_authorization_endpoint2 s z:OidcDeviceAuthorization._get_device_authorization_endpoint)r2 c C s, d}t �|�}t�|��d�}|�d�}|S )z5Generate PKCE verifier string as defined in RFC 7636.�* �ascii�=)�os�urandom�base64�urlsafe_b64encode�decode�rstrip)r, Z raw_bytesZ_randZ _rand_b64� code_verifierr/ r/ r0 �_generate_pkce_verifierM s z/OidcDeviceAuthorization._generate_pkce_verifierc C sj | j dvrt�� �| �� | _| j dkr,| jS | j dkrf| j�d�}t�|��� }t � |�� d�� d�S dS )z6Generate PKCE challenge string as defined in RFC 7636.)�plain�S256r� r� r� r� N) r� r Z OidcInvalidCodeChallengeMethodr� r� �encode�hashlib�sha256�digestr� r� r� r� )r, Z_tmp�_hashr/ r/ r0 �_generate_pkce_challengeU s z0OidcDeviceAuthorization._generate_pkce_challengec C sf | � |�}|dusJ �| jr.| j| jf}i }nd}d| ji}| jrh| �� | _|�d| j� |�d| j� t�|�}t � t j �r�| � |�}t �d||� |j||| j|ddd�}t � t j �r�| � |�� �}t �d||� t|�� d �| _t�� | j | _|�� d | _t|�� d �| _|�� d | _|�� d | _|�� d | _d | ji}| j�rb|�d| j� |S )a" Get an authorization grant for the "device_code" grant type. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :returns: a python dictionary containing the payload to be exchanged :rtype: dict Nr r� r� rO F)rP rb rA rQ r3 rR � expires_in� device_code�interval� user_code�verification_uri�verification_uri_completer� ) r� r r r� r� r� rS �urlparse� urlencoder5 rT rU rV rL rW rX � HEADER_X_FORMr7 �intr� �time�timeoutr� r� r� r� r� r� ) r, r Zdevice_authz_endpointrZ rN �encoded_payloadr[ r\ r^ r/ r/ r0 rg d sf � � �� �� z#OidcDeviceAuthorization.get_payloadrM c C sd t �d| j� �� | jr&| j| jf}nd}|�d| j� | �|�}t�|�}t � � | j k �r.zht � t j �r�| �|�}t �d||� |j|||| jddd�}t � t j �r�| �|�� �}t �d||� W nb tjj�y& } zD| jo�| j�� �d�} | d kr�� t �| j� W Y d} ~ qLW Y d} ~ n d} ~ 0 0 �qBqL| d k�rBtj�� �|�� | j } t | t ��s`J �| S ) a� Poll token endpoint for an access token. :param session: a session object to send out HTTP requests. :type session: keystoneauth1.session.Session :param payload: a dict containing various OpenID Connect values, for example:: { 'grant_type': 'urn:ietf:params:oauth:grant-type:device_code', 'device_code': self.device_code, } :type payload: dict z To authenticate please go to: Nr rO F)rP rA rb rQ r3 rR r6 Zauthorization_pending) r5 �warningr� r r rS r@ r� r� r� r� rT rU rV rL rW rX r� r7 r �httpZ BadRequestr] r4 �sleepr� r� Z OidcDeviceAuthorizationTimeOutr rY r= ) r, r rN rZ r r� r[ r\ r^ �excr6 r_ r/ r/ r0 r` � sZ � �� � " z)OidcDeviceAuthorization._get_access_token)r NNNNN)rn ro rp rq r r� r= r; re rt r) ru rv r� r� r� rw rg r` r} r/ r/ r- r0 r� � sl ���C� � J�r� )%r{ r� rH r� rU r� r� �typingr; �urllibr r� ry Z keystoneauth1r �utilsr r Zkeystoneauth1.identity.v3r r ru Z get_loggerrn r5 �__all__rK �TypeVarr ZFederationBaseAuth�ABCMetar r r r r r� r/ r/ r/ r0 �<module> s4 JxIOd
| ver. 1.1 | |
.
| PHP 8.3.30 | Ð“ÐµÐ½ÐµÑ€Ð°Ñ†Ð¸Ñ Ñтраницы: 0 |
proxy
|
phpinfo
|
ÐаÑтройка