Файловый менеджер - Редактировать - /opt/imh-python/lib/python3.9/site-packages/keystoneauth1/extras/_saml2/v3/__pycache__/saml2.cpython-39.pyc
Ðазад
a s�h{7 � @ sb d dl Z d dlZzd dlmZ W n ey6 dZY n0 d dlZd dlZd dlm Z d dlm Z d dl m Z d dlm Z dZdZd Zd e� d e� d �Zed ed�ZdZdZed Zed ZdZG dd� de�ZG dd� de�ZG dd� de�Z ej e ej d�dd �Z ej e e d �d d �Z!ej"d ej#d!�Z$G d"d#� d#ej%j&�Z'G d$d%� d%e j(�Z)G d&d'� d'e)�Z*dS )(� N)�etree)�access)� exceptions)�v3)�sessionzurn:liberty:paos:2003-08z,urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecpzapplication/vnd.paos+xmlzver="z";"�"z)http://schemas.xmlsoap.org/soap/envelope/)Zecp�SZpaosz/S:Envelope/S:Header/z//ecp:RelayStatez!paos:Request/@responseConsumerURLz)ecp:Response/@AssertionConsumerServiceURLa^ <S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"> <S:Body> <S:Fault> <faultcode>S:Server</faultcode> <faultstring>responseConsumerURL from SP and assertionConsumerServiceURL from IdP do not match </faultstring> </S:Fault> </S:Body> </S:Envelope> c @ s e Zd ZdZdS )� SamlExceptionzBase SAML plugin exception.N��__name__� __module__� __qualname__�__doc__� r r ��/root/rpmbuild/BUILDROOT/imh-python39-modules-3.9.7-92.el8.x86_64/opt/imh-python/lib/python3.9/site-packages/keystoneauth1/extras/_saml2/v3/saml2.pyr > s r c @ s e Zd ZdZdS )�InvalidResponsez*Invalid Response from SAML authentication.Nr r r r r r B s r c @ s e Zd ZdZdS )�ConsumerMismatchz&The SP and IDP consumers do not match.Nr r r r r r F s r )�response�name�returnc C sR zt �| j�W S t jyL } z$d|� d|� �}t|��W Y d }~n d }~0 0 d S )Nz'SAML2: Error parsing XML returned from z: )r �XML�contentZXMLSyntaxErrorr )r r �e�msgr r r � _response_xmlJ s r )�xml�pathr c C s8 | j |td�}t|�dkr(t|� d���|d }t|�S )N�� namespaces� z% should provide a single element listr )�xpath�_XML_NAMESPACES�len� IndexError�str)r r Zli�resultr r r � _str_from_xmlR s r& �_PreparedRequestT)�boundc s� e Zd ZdZeejdejj e eef f d�� fdd� Z e e d�dd�Z ejejejd �d d �Zejejejd �d d�Z� ZS )� _SamlAutha� A generic SAML ECP plugin for requests. This is a multi-step process including multiple HTTP requests. Authentication consists of: * HTTP GET request to the Service Provider. It's crucial to include HTTP headers indicating we are expecting SOAP message in return. Service Provider should respond with a SOAP message. * HTTP POST request to the external Identity Provider service with ECP extension enabled. The content sent is a header removed SOAP message returned from the Service Provider. It's also worth noting that ECP extension to the SAML2 doesn't define authentication method. The most popular is HttpBasicAuth with just user and password. Other possibilities could be X509 certificates or Kerberos. Upon successful authentication the user should receive a SAML2 assertion. * HTTP POST request again to the Service Provider. The body of the request includes SAML2 assertion issued by a trusted Identity Provider. The request should be sent to the Service Provider consumer url specified in the SAML2 assertion. Providing the authentication was successful and both Service Provider and Identity Providers are trusted to each other, the Service Provider will issue an unscoped token with a list of groups the federated user is a member of. N)�identity_provider_url� requests_authc s t � �� || _|| _d S �N)�super�__init__r* r+ )�selfr* r+ �� __class__r r r. ~ s z_SamlAuth.__init__)�requestr c C s\ z|j d }W n ty* t|j d< Y n0 d�|tg�|j d< t|j d< |�d| j� |S )N�Accept�,ZPAOSr )�headers�KeyError� _PAOS_HEADER�join� _PAOS_VER� register_hook�_handle_response)r/ r2 �acceptr r r �__call__� s z_SamlAuth.__call__)r �kwargsr c K s0 |j dkr,|j�d�tkr,| j|fi |��}|S )N�� � Content-Type)� status_coder5 �getr7 � _ecp_retry)r/ r r> r r r r; � s ��z_SamlAuth._handle_response)� sp_responser> r c s� �g}dt t tjt t f ttjd tjjtt t f f tj tj j tj d�� �fdd� }t �d�}|jttd�d }t|t�}|�|d � |d| jdd it�|�| jd �}|�|� t |d �} t| t�} || k�r|d|t�d �d t id� d} | �j j || j| d� } t | ��|| d d< |d| d t i|j t�| �d�} |�| � | j tj!j"tj!j#fv �r��j$ �j%�&� �j �'� } | j(d | _ | �)| j � �j*j+| fi � ��} |�| � | j,�-|� | S )N)�method�urlr5 �data�auth�cookiesr c s. t j| |||||d�}�jj|�� fi � ��S )N)rE rF r5 rG rH rI )�requests�Request� connection�send�prepare)rE rF r5 rG rH rI �req�r> rD r r rM � s �z"_SamlAuth._ecp_retry.<locals>.sendzService Providerr r �POSTz Content-typeztext/xml)r5 rG rH zIdentity Providerzutf-8r@ )rG r5 z�Consumer URLs from Service Provider %(service_provider)s %(sp_consumer_url)s and Identity Provider %(identity_provider)s %(idp_consumer_url)s are not equal)Zservice_provider�sp_consumer_url�identity_provider�idp_consumer_url)r5 rI rG �location)NN).r$ �ty�Mapping�bytes�UnionrJ rH �AuthBase�tuple�OptionalrI �RequestsCookieJar�Responser r �_XPATH_SP_RELAY_STATEr! r& �_XPATH_SP_CONSUMER_URL�remover* r Ztostringr+ �append�_XPATH_IDP_CONSUMER_URL� _SOAP_FAULT�encoder7 r2 rF r rA �codes�found�otherr �raw� release_conn�copyr5 �prepare_cookiesrL rM �history�extend)r/ rD r> rm rM Z authn_requestZ relay_staterR Z idp_responseZauthn_responserT r Z final_resprO r rP r rC � s� � � � �� � � � �� � � z_SamlAuth._ecp_retry)r r r r r$ rV rY rJ rH rZ r[ r. r' r= r^ �Anyr; rC � __classcell__r r r0 r r) _ s � � �r) c s� e Zd Zddddddddddd� eeeeeje eje eje eje eje eje eje eje eed�� fdd�Zej e j j d�dd ��Z ejejd �d d �Z� ZS ) �_FederatedSamlNT� �trust_id� system_scope� domain_id� domain_name� project_id� project_name�project_domain_id�project_domain_name�reauthenticate�include_catalog)�auth_urlrS �protocolr* rs rt ru rv rw rx ry rz r{ r| c s0 t � j|||||||| | | | | |d� || _d S �Nrr )r- r. r* )r/ r} rS r~ r* rs rt ru rv rw rx ry rz r{ r| r0 r r r. s �z_FederatedSaml.__init__�r c C s t � �d S r, )�NotImplementedError�r/ r r r �get_requests_auth. s z _FederatedSaml.get_requests_auth)r r c C s~ | � � }t| j|�}z|j| j|dd�}W n2 ty\ } zt�t|���W Y d }~n d }~0 0 t j |d�}t |t j �szJ �|S )NF)r+ � authenticated)�resp) r� r) r* rB Zfederated_token_urlr r ZAuthorizationFailurer$ r �create� isinstance� AccessInfoV3)r/ r rE rH r� r Z access_infor r r �get_unscoped_auth_ref2 s � $ z$_FederatedSaml.get_unscoped_auth_ref)r r r r$ rV r\ �boolr. �abc�abstractmethodrJ rH rZ r� � ks_session�Sessionr r� r� rp r r r0 r rq s> ��#�rq c s� e Zd ZdZddddddddddd� eeeeeeeje eje eje eje eje eje eje eje eed�� fdd�Ze j j d�d d �Z � Z S ) �PasswordaH Implement authentication plugin for SAML2 protocol. ECP stands for `Enhanced Client or Proxy` and is a SAML2 extension for federated authentication where a transportation layer consists of HTTP protocol and XML SOAP messages. `Read for more information <https://wiki.shibboleth.net/confluence/display/CONCEPT/ECP>`_ on ECP. Reference the `SAML2 ECP specification <https://www.oasis-open.org/\ committees/download.php/49979/saml-ecp-v2.0-wd09.pdf>`_. Currently only HTTPBasicAuth mechanism is available for the IdP authenication. :param auth_url: URL of the Identity Service :type auth_url: string :param identity_provider: name of the Identity Provider the client will authenticate against. This parameter will be used to build a dynamic URL used to obtain unscoped OpenStack token. :type identity_provider: string :param identity_provider_url: An Identity Provider URL, where the SAML2 authn request will be sent. :type identity_provider_url: string :param username: User's login :type username: string :param password: User's password :type password: string :param protocol: Protocol to be used for the authentication. The name must be equal to one configured at the keystone sp side. This value is used for building dynamic authentication URL. Typical value would be: saml2 :type protocol: string NTrr )r} rS r~ r* �username�passwordrs rt ru rv rw rx ry rz r{ r| c s8 t � j||||||| | | | | |||d� || _|| _d S r )r- r. r� r� )r/ r} rS r~ r* r� r� rs rt ru rv rw rx ry rz r{ r| r0 r r r. r s$ �zPassword.__init__r� c C s t j�| j| j�S r, )rJ rH � HTTPBasicAuthr� r� r� r r r r� � s zPassword.get_requests_auth)r r r r r$ rV r\ r� r. rJ rH rZ r� rp r r r0 r r� F s< 4��'r� )+r� �typingrV Zlxmlr � ImportErrorrJ Z requests.authZ keystoneauth1r r Zkeystoneauth1.identityr r r� Z_PAOS_NAMESPACEZ_ECP_NAMESPACEr7 r9 r! Z_XBASEr_ r` rc rd � Exceptionr r r r^ r$ Z_Elementr r& �TypeVar�PreparedRequestr' rH rZ r) ZFederationBaseAuthrq r� r r r r �<module> sH �� ,<
| ver. 1.1 | |
.
| PHP 8.3.30 | Ð“ÐµÐ½ÐµÑ€Ð°Ñ†Ð¸Ñ Ñтраницы: 0 |
proxy
|
phpinfo
|
ÐаÑтройка