/usr/lib/python2.6/site-packages/keystoneauth1/extras/_saml2/v3
Edit: /usr/lib/python2.6/site-packages/keystoneauth1/extras/_saml2/v3/adfs.pyc (16295B)
Ņō
7
Wc
@ s
d d k Z d d k Z d d k l Z d d k l Z d d k l Z d d k l Z d d k l
Z
d e
i f d YZ d S( iĸĸĸĸN( t etree( t urllib( t access( t
exceptions( t baset Passwordc B s· e Z d Z d Z h d d 6Z h d d 6Z h d d 6d d 6d d
6Z h d d 6d d 6Z d
Z d Z d Z
d d Z d Z d Z
d Z d Z d Z d Z RS( s1 Authentication plugin for Microsoft ADFS2.0 IdPs.ix s# application/soap+xml; charset=utf-8s Content-Types! application/x-www-form-urlencodeds' http://www.w3.org/2003/05/soap-envelopet ss$ http://www.w3.org/2005/08/addressingt asR http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdt us0 http://docs.oasis-open.org/ws-sx/ws-trust/200512t tsZ /s:Envelope/s:Body/t:RequestSecurityTokenResponseCollection/t:RequestSecurityTokenResponsec
K sD t t | i d | d | d | d | d | d | | | _ d S( sô Constructor for ``ADFSPassword``.
:param auth_url: URL of the Identity Service
:type auth_url: string
:param identity_provider: name of the Identity Provider the client
will authenticate against. This parameter
will be used to build a dynamic URL used to
obtain unscoped OpenStack token.
:type identity_provider: string
:param identity_provider_url: An Identity Provider URL, where the SAML2
authentication request will be sent.
:type identity_provider_url: string
:param service_provider_endpoint: Endpoint where an assertion is being
sent, for instance: ``https://host.domain/Shibboleth.sso/ADFS``
:type service_provider_endpoint: string
:param username: User's login
:type username: string
:param password: User's password
:type password: string
t auth_urlt identity_providert identity_provider_urlt usernamet passwordt protocolN( t superR t __init__t service_provider_endpoint( t selfR
R R R R
R R t kwargs( ( sJ /tmp/pip-build-wCUybK/keystoneauth1/keystoneauth1/extras/_saml2/v3/adfs.pyR / s
c C s7 y t | i SWn t j
o n Xt | i i S( sŲ Check if cookie jar is not empty.
keystoneauth1.session.Session object doesn't have a cookies attribute.
We should then try fetching cookies from the underlying
requests.Session object. If that fails too, there is something wrong
and let Python raise the AttributeError.
:param session
:returns: True if cookie jar is nonempty, False otherwise
:raises AttributeError: in case cookies are not find anywhere
( t boolt cookiest AttributeErrort session( R R ( ( sJ /tmp/pip-build-wCUybK/keystoneauth1/keystoneauth1/extras/_saml2/v3/adfs.pyt _cookiesS s
s %Y-%m-%dT%H:%M:%S.%fZc C sV t i i } | t i d | i } g } | | f D] } | | i | q9 ~ S( sð Calculate created and expires datetime objects.
The method is going to be used for building ADFS Request Security
Token message. Time interval between ``created`` and ``expires``
dates is now static and equals to 120 seconds. ADFS security tokens
should not be live too long, as currently ``keystoneauth1``
doesn't have mechanisms for reusing such tokens (every time ADFS authn
method is called, keystoneauth1 will login with the ADFS instance).
:param fmt: Datetime format for specifying string format of a date.
It should not be changed if the method is going to be used
for building the ADFS security token request.
:type fmt: string
t seconds( t datetimet utcnowt timedeltat DEFAULT_ADFS_TOKEN_EXPIRATIONt strftime( R t fmtt date_createdt date_expirest _[1]t _time( ( sJ /tmp/pip-build-wCUybK/keystoneauth1/keystoneauth1/extras/_saml2/v3/adfs.pyt _token_datesg s
c C sŲ h d d 6} h d d 6} h d d 6} h d d 6} t i d d
| i } t i | d } t i | d } | i d
d d | _ t i | d } d t i i | _ t i | d } t i | d }
d |
_ t i | d } | i d
d t i | d d
| } | i d
d t i | d }
|
i d d t i |
d } t i |
d } | i \ | _ | _ t i | d } | i d d t i i t i | d } t i | d d! d" } t i | d# } t i | d$ d
| } t i | d% d
| } t i | d& d
| } t i | d } t i | d' } d( | _ t i | d) } d* | _ t i | d+ } d, | _ | i
| _ | i | _ | i | _ | i
| _ | | _ d- S(. s Build the ADFS Request Security Token SOAP message.
Some values like username or password are inserted in the request.
sQ http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdt os0 http://docs.oasis-open.org/ws-sx/ws-trust/200512t trusts, http://schemas.xmlsoap.org/ws/2004/09/policyt wsps$ http://www.w3.org/2005/08/addressingt wsas1 {http://www.w3.org/2003/05/soap-envelope}Envelopet nsmaps/ {http://www.w3.org/2003/05/soap-envelope}Headers, {http://www.w3.org/2005/08/addressing}Actions7 {http://www.w3.org/2003/05/soap-envelope}mustUnderstandt 1s: http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issues/ {http://www.w3.org/2005/08/addressing}MessageIDs urn:uuid:s- {http://www.w3.org/2005/08/addressing}ReplyTos- {http://www.w3.org/2005/08/addressing}Addresss. http://www.w3.org/2005/08/addressing/anonymouss( {http://www.w3.org/2005/08/addressing}Tos[ {http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Securitys] {http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}TimestampsV {http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Idt _0s[ {http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Createds[ {http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}Expiress` {http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}UsernameTokensU {http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd}us uuid-%s-1s[ {http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Usernames[ {http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Passwordt Types_ http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordTexts- {http://www.w3.org/2003/05/soap-envelope}BodysF {http://docs.oasis-open.org/ws-sx/ws-trust/200512}RequestSecurityTokens7 {http://schemas.xmlsoap.org/ws/2004/09/policy}AppliesTos7 {http://www.w3.org/2005/08/addressing}EndpointReferences9 {http://docs.oasis-open.org/ws-sx/ws-trust/200512}KeyTypes7 http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearers= {http://docs.oasis-open.org/ws-sx/ws-trust/200512}RequestTypes6 http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issues; {http://docs.oasis-open.org/ws-sx/ws-trust/200512}TokenTypes% urn:oasis:names:tc:SAML:1.0:assertionN( R t Elementt
NAMESPACESt
SubElementt sett textt uuidt uuid4t hexR% R
R R R t prepared_request( R t WSS_SECURITY_NAMESPACEt TRUST_NAMESPACEt
WSP_NAMESPACEt
WSA_NAMESPACEt roott headert actiont messageIDt replyIDt addresst tot securityt timestampt createdt expirest
usernametokenR
R t bodyt request_security_tokent
applies_tot endpoint_referencet wsa_addresst keytypet request_typet
token_type( ( sJ /tmp/pip-build-wCUybK/keystoneauth1/keystoneauth1/extras/_saml2/v3/adfs.pyt _prepare_adfs_request| sŪ
c
s§ f d } i i } y. | i d i d i d | d t } Wn3 t i j
o$ } | | } t i | n Xd } i | i
| _ d S( si Send ADFS Security token to the ADFS server.
Store the result in the instance attribute and raise an exception in
case the response is not valid XML data.
If a user cannot authenticate due to providing bad credentials, the
ADFS2.0 server will return a HTTP 500 response and a XML Fault message.
If ``exceptions.InternalServerError`` is caught, the method tries to
parse the XML response.
If parsing is unsuccessful, an ``exceptions.AuthorizationFailure`` is
raised with a reason from the XML fault. Otherwise an original
``exceptions.InternalServerError`` is re-raised.
:param session : a session object to send out HTTP requests.
:type session: keystoneauth1.session.Session
:raises keystoneauth1.exceptions.AuthorizationFailure: when HTTP
response from the ADFS server is not a valid XML ADFS security
token.
:raises keystoneauth1.exceptions.InternalServerError: If response
status code is HTTP 500 and the response XML cannot be
recognized.
c sv d } | i i } y; i | i | d i } i | } | i SWn" t t i f j
o
| n Xd S( Ns3 /s:Envelope/s:Body/s:Fault/s:Code/s:Subcode/s:Valuet
namespaces(
t responset contentt
str_to_xmlt xpathR/ t _firstR2 t
IndexErrorR t AuthorizationFailure( t eRT RR t obj( R ( sJ /tmp/pip-build-wCUybK/keystoneauth1/keystoneauth1/extras/_saml2/v3/adfs.pyt _get_failure s t urlt headerst datat
authenticatedsF Error parsing XML returned from the ADFS Identity Provider, reason: %sN( t
xml_to_strR6 t postR t HEADER_SOAPt FalseR t InternalServerErrorRW RS RR t
adfs_token( R R RZ RH RQ RX t reasont msg( ( R sJ /tmp/pip-build-wCUybK/keystoneauth1/keystoneauth1/extras/_saml2/v3/adfs.pyt _get_adfs_security_token s c C sq | i i | i d | i } | i | } | i | } | i d d } t i i | } d | | _
d S( s) Prepare ADFS Security Token to be sent to the Service Provider.
The method works as follows:
* Extract SAML2 assertion from the ADFS Security Token.
* Replace namespaces
* urlencode assertion
* concatenate static string with the encoded assertion
RP s0 http://docs.oasis-open.org/ws-sx/ws-trust/200512s+ http://schemas.xmlsoap.org/ws/2005/02/trusts wa=wsignin1.0&wresult=N( Rd RT t ADFS_ASSERTION_XPATHt ADFS_TOKEN_NAMESPACESRU R_ t replaceR t parset quotet encoded_assertion( R t assertionRm ( ( sJ /tmp/pip-build-wCUybK/keystoneauth1/keystoneauth1/extras/_saml2/v3/adfs.pyt _prepare_sp_request9 s
c C s5 | i d | i d | i d | i d t d t d S( s Send prepared assertion to a service provider.
As the assertion doesn't contain a protected resource, the value from
the ``location`` header is not valid and we should not let the Session
object get redirected there. The aim of this call is to get a cookie in
the response which is required for entering a protected endpoint.
:param session : a session object to send out HTTP requests.
:type session: keystoneauth1.session.Session
:raises: Corresponding HTTP error exception
R[ R] R\ t redirectR^ N( R` R Rm t
HEADER_X_FORMRb ( R R ( ( sJ /tmp/pip-build-wCUybK/keystoneauth1/keystoneauth1/extras/_saml2/v3/adfs.pyt# _send_assertion_to_service_providerR s c C sH | i | t j o t i d n | i | i d t | _ d S( s Access protected endpoint and fetch unscoped token.
After federated authentication workflow a protected endpoint should be
accessible with the session object. The access is granted basing on the
cookies stored within the session object. If, for some reason no
cookies are present (quantity test) it means something went wrong and
user will not be able to fetch an unscoped token. In that case an
``exceptions.AuthorizationFailure` exception is raised and no HTTP call
is even made.
:param session : a session object to send out HTTP requests.
:type session: keystoneauth1.session.Session
:raises keystoneauth1.exceptions.AuthorizationFailure: in case session
object has empty cookie jar.
sw Session object doesn't contain a cookie, therefore you are not allowed to enter the Identity Provider's protected area.R^ N( R Rb R RW t gett federated_token_urlt authenticated_response( R R ( ( sJ /tmp/pip-build-wCUybK/keystoneauth1/keystoneauth1/extras/_saml2/v3/adfs.pyt _access_service_providerd s
c G sN | i | i | | i | i | | i | t i d | i S( sj Retrieve unscoped token after authentcation with ADFS server.
This is a multistep process:
* Prepare ADFS Request Securty Token -
build an etree.XML object filling certain attributes with proper user
credentials, created/expires dates (ticket is be valid for 120
seconds as currently we don't handle reusing ADFS issued security
tokens).
* Send ADFS Security token to the ADFS server. Step handled by
* Receive and parse security token, extract actual SAML assertion and
prepare a request addressed for the Service Provider endpoint.
This also includes changing namespaces in the XML document. Step
handled by ``ADFSPassword._prepare_sp_request()`` method.
* Send prepared assertion to the Service Provider endpoint. Usually
the server will respond with HTTP 301 code which should be ignored as
the 'location' header doesn't contain protected area. The goal of
this operation is fetching the session cookie which later allows for
accessing protected URL endpoints. Step handed by
``ADFSPassword._send_assertion_to_service_provider()`` method.
* Once the session cookie is issued, the protected endpoint can be
accessed and an unscoped token can be retrieved. Step handled by
``ADFSPassword._access_service_provider()`` method.
:param session: a session object to send out HTTP requests.
:type session: keystoneauth1.session.Session
:returns: AccessInfo
:rtype: :py:class:`keystoneauth1.access.AccessInfo`
t resp( RO Rg Ro Rr Rv R t createRu ( R R R ( ( sJ /tmp/pip-build-wCUybK/keystoneauth1/keystoneauth1/extras/_saml2/v3/adfs.pyt get_unscoped_auth_ref} s $
( t __name__t
__module__t __doc__R Ra Rq R/ Ri Rh R R R% RO Rg Ro Rr Rv Ry ( ( ( sJ /tmp/pip-build-wCUybK/keystoneauth1/keystoneauth1/extras/_saml2/v3/adfs.pyR s*
$ 6 (
R R3 t lxmlR t six.movesR t
keystoneauth1R R t keystoneauth1.extras._saml2.v3R t BaseSAMLPluginR ( ( ( sJ /tmp/pip-build-wCUybK/keystoneauth1/keystoneauth1/extras/_saml2/v3/adfs.pyt
s