File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/__pycache__/__init__.cpython-310.pyc
Back
o ;j�] � @ s� d Z ddlZddlZddlZddlZddlmZmZ ddlZ ddl Z ddl Z ddl Z ddl Z ddlZ ddlZ ddlZ ddlZ ddlZ ddlZ ddlZ e�e�Zeg d��ZG dd� d�ZG dd� d�ZG d d � d �Z dS ) z� Salt's pluggable authentication system This system allows for authentication to be managed in a module pluggable way so that any external authentication system can be used inside of Salt � N)�Iterable�Mapping) �client�cmd�eauthZfunZgather_job_timeout�kwarg�match�metadataZ print_event�rawZyield_pub_datac @ s� e Zd ZdZd,dd�Zdd� Zdd� Zd d � Zd d � Zd d� Z dd� Z dd� Z dd� Z dd� Z dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd,d'd(�Zd-d*d+�ZdS ).�LoadAuthzH Wrap the authentication system to handle peripheral components Nc C s@ || _ d| _tj�|�| _tj�|�| _|p tjj� |�| _ d S )Ng �?) �opts�max_fail�salt�loader�auth� eauth_tokens�tokens�utilsZminionsZ CkMinions� ckminions)�selfr r � r �F/opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/__init__.py�__init__: s zLoadAuth.__init__c C s� t | d�r| jdurt | jd�r| j�� i | _t | d�r0| jdur0t | jd�r-| j�� i | _t | d�r\| jdur^t | jd�rW| jjdurWt | jjd�rS| jj�� d| j_d| _dS dS dS )z$ Clean up resources r N�destroyr r �cache)�hasattrr r r r r �r r r r r A s �zLoadAuth.destroyc C s | S �Nr r r r r � __enter__T s zLoadAuth.__enter__c G s | � � d S r )r )r �argsr r r �__exit__W s zLoadAuth.__exit__c C sd d|vrdS d� |d �}|| jvrdS ztjj�| j| �d d }|| W S ty1 Y dS w )z� Return the primary name associate with the load, if an empty string is returned then the load does not match the function r � �{}.authr r )�formatr r r r � arg_lookup� IndexError)r �load�fstrZ pname_argr r r � load_nameZ s �zLoadAuth.load_namec s� d|vrdS d� |d �}|| jvrdS g d�� � fdd�|�� D �}tjjj| j| |td�}z d|v rD| j| |d i |d ��W S | j| |d � W S tyf } z t � d |� W Y d }~dS d }~ww ) z� Return the token and set the cache data for use Do not call this directly! Use the time_auth method to overcome timing attacks r Fr" )�username�passwordr �tokenc s i | ] \}}|� v r||�qS r r )�.0�key�value�Z_validr r � <dictcomp>y s z(LoadAuth.__auth_call.<locals>.<dictcomp>�Zexpected_extra_kws�kwargsr � Authentication module threw %sN) r# r �itemsr r r � format_call�AUTH_INTERNAL_KEYWORDS� Exception�log�debug)r r& r' �_load�fcall�er r/ r Z __auth_callj s& � ��zLoadAuth.__auth_callc C s� t � � }| �|�}|r |S t � � | }|| jkr|| _| jd }t�� �| j| | j| �}|| t � � krCt �d� || t � � ks6dS )zO Make sure that all failures happen in the same amount of time � g����MbP?F)�time�_LoadAuth__auth_callr �random� SystemRandom�uniform�sleep)r r& �start�retZf_timeZ deviationZr_timer r r � time_auth� s � �zLoadAuth.time_authc C s� d|vrdS | j d }|s|d }|� d�}|| jvr dS tjjj| j| |td�}z| j| |d i |d ��W S tyR } z t� d|� W Y d}~dS d}~ww ) z� Returns ACL for a specific user. Returns None if eauth doesn't provide any for the user. I. e. None means: use acl declared in master config. r NZeauth_acl_modulez.aclr1 r r2 r3 ) r r r r r r5 r6 r7 r8 r9 )r r& �modr' r; r< r r r Z __get_acl� s$ � ��zLoadAuth.__get_aclc C sr d|vr|S d� |d �}|| jvr|S z | j| || j�W S ty8 } zt�d|� |W Y d}~S d}~ww )z� Allows eauth module to modify the access list right before it'll be applied to the request. For example ldap auth module expands entries r z{}.process_aclr3 N)r# r r r7 r8 r9 )r r& � auth_listr' r< r r r Z __process_acl� s ��zLoadAuth.__process_aclc C s� d|vrdS d� |d �}|| jvrdS tjjj| j| |td�}z| j| |d i |d ��W S ty: Y dS tyC Y dS w )zw Read in a load and return the groups a user is a member of by asking the appropriate provider r Fz {}.groupsr1 r r2 N) r# r r r r r5 r6 r% r7 )r r& r' r; r r r � get_groups� s � �zLoadAuth.get_groupsc C sT | j �dd�}|du r dS t|t�r(|�|d g �}t|t�r(|�d�|v r(dS dS )zP Return bool if requesting user is allowed to set custom expire Ztoken_expire_user_overrideFTr r) )r �get� isinstancer r )r r& Zexpire_overrideZexpire_whitelistr r r �_allow_custom_expire� s z LoadAuth._allow_custom_expirec C s� | � |�si S | �|�r|�d| jd �}n |�dd�}| jd }t�� t�� | | �|�|d d�}| jd rA| �|�}||d< | �|�}|rL||d< | jd� | jd � | j|�S ) zM Run time_auth and create a token. Return False or the token � token_expireNr )rD �expire�namer �keep_acl_in_tokenrH �groupsz {}.mk_tokenr ) �authenticate_eauthrL �popr r> r( �_LoadAuth__get_aclrI r r# )r r& rM �_�tdataZacl_retrQ r r r �mk_token� s( � �zLoadAuth.mk_tokenc C s� z| j d�| jd � | j|�}W nJ tjjy: } zt�d||� tjddd� | � |� i W Y d}~S d}~w t y[ } zt�d||� tjd dd� i W Y d}~S d}~ww |s`i S |� d d �t � � k rq| � |� i S |S ) zg Return the name associated with the token, or False if the token is not valid z {}.get_tokenr zDToken %r could not be deserialized (%r); removing it from the store.z Token deserialization traceback:T)�exc_infoNz�Token store transient error reading %r (%r); treating as not-authenticated for this request without removing the token from the store.z&Token store transient-error traceback:rN r ) r r# r r � exceptionsZSaltDeserializationErrorr8 �warningr9 �rm_token�OSErrorrJ r> )r �tokrV �excr r r �get_tok s< � � � ��� zLoadAuth.get_tokc C s | j d�| jd � | j�S )z8 List all tokens in eauth_tokn storage. z{}.list_tokensr �r r# r r r r r � list_tokens@ s �zLoadAuth.list_tokensc C s" | j d�| jd � | j|� dS )z< Remove the given token from token storage. z {}.rm_tokenr Nr` )r r] r r r r[ H s "zLoadAuth.rm_tokenc C s6 | � |d �}|r|d | jd vrt�d� dS |S )z~ Authenticate a user by the token specified in load. Return the token object or False if auth failed. r+ r � external_auth�0Authentication failure of type "token" occurred.F)r_ r r8 rZ )r r& r+ r r r �authenticate_tokenN s zLoadAuth.authenticate_tokenc C sb d|vr t �d� dS |d | jd vr#t �d|d � t �d� dS | �|�s/t �d� dS dS )z� Authenticate a user by the external auth module specified in load. Return True on success or False on failure. r z0Authentication failure of type "eauth" occurred.Frb �$The eauth system "%s" is not enabledT)r8 rZ r rF )r r& r r r rR \ s zLoadAuth.authenticate_eauthc C s� d}|� dd�}|du rt�|� dS d|v r�t|d �}|�� r4|D ]}||| kr1|�� S q#dS |d | j�dd�ksE|d dkrh|D ] }||| krR dS qGt�d| j�dd�|d � t�|� dS |�� r~||�|d �kr|t�|� dS dS ||�d�kr� dS ||�d �kr� dS |d |v r�|||d kr�t�|� dS |d S t�|� dS |D ] }||| kr� dS q�t�|� dS ) a Authenticate a user by the key passed in load. Return the effective user id (name) if it's different from the specified one (for sudo). If the effective user id is the same as the passed one, return True on success or False on failure. z/Authentication failure of type "user" occurred.r- NF�user�rootTz,Master runs as %r, but user in payload is %rr ) rS r8 rZ �AuthUser�is_sudo� sudo_namer rJ �is_running_user)r r& r- Z error_msgZauth_keyZ auth_userZ check_keyr r r �authenticate_keyr sb �" � � �� � � zLoadAuth.authenticate_keyc C s� |r| j d rd|v r|d S | �|�}|dur|S |r |d n|d }|| j d vr8t�d|� t�d� dS |rD|d }|�d �}n | �|�}| �|�}| j d | }|s]t�d |� |sag }| j� |||�}| � ||�}t� d |� |S ) a� Retrieve access list for the user specified in load. The list is built by eauth module or from master eauth configuration. Return None if current configuration doesn't provide any ACL for the user. Return an empty list if the user has no rights to execute anything on this master and returns non-empty list if user is allowed to execute particular functions. rP rH Nr rb re z Authorization failure occurred.rO rQ z!eauth "%s" configuration is emptyzCompiled auth_list: %s) r rT r8 r9 rZ rJ r( rI r Zfill_auth_list�_LoadAuth__process_aclZtrace)r r& r+ rH r rO rQ Z eauth_configr r r � get_auth_list� s0 zLoadAuth.get_auth_listFc C sh g }|� dd�}||i d�}|dkr2| �|�}|s"ddd�|d< |S |d }||d< | j||d �}n||d krM| �|�sGd d �|�d�|d< |S | �|�}na|dkr�| �||�} d} | sn|re| � d|� d�} d| d�|d< |S | dur�t|d ��� r�| jd r�| jd s�d} | dur�ddl } | j j � | jd | �}|s�d| d�|d< |S n ddd�|d< |S ||d< |S )a� .. versionadded:: 2018.3.0 Go through various checks to see if the token/eauth/user can be authenticated. Returns a dictionary containing the following keys: - auth_list - username - error If an error is encountered, return immediately with the relevant error dictionary as authentication has failed. Otherwise, return the username and valid auth_list. r) �UNKNOWN)rH r) �errorr+ ZTokenAuthenticationErrorrc )rO �messagerp rO )r+ r ZEauthAuthenticationErrorz<Authentication failure of type "eauth" occurred for user {}.rf z.Authentication failure of type "user" occurredz for user �.ZUserAuthenticationErrorTZsudo_aclZ publisher_aclr NZSaltInvocationErrorz"Authentication type not supported.rH ) rJ rd rn rR r# rl rh ri r Zsalt.utils.masterr ZmasterZget_values_of_matching_keys) r r& Z auth_typer- Z show_usernamerH r) rE r+ Zauth_ret�msgr r r r �check_authentication� sb � � � �� �z LoadAuth.check_authenticationr )NF)�__name__� __module__� __qualname__�__doc__r r r r r( r? rF rT rm rI rL rW r_ ra r[ rd rR rl rn rt r r r r r 5 s, : @.r c @ s@ e Zd ZdZdd� Zdd� Zdd� Zdd � Zd d � Zd d � Z dS )�Resolverzk The class used to resolve options for the command line and for generic interactive interfaces c C s || _ tj�|�| _d S r )r r r r )r r r r r r 7 s zResolver.__init__c C sl d� tjj�| jd �t| jd ��}tjjj j | jd|d�� }|� |�W d � S 1 s/w Y d S )Nz tcp://{}:{}Z interfaceZret_port�clear)Zcrypt� master_uri) r# r r �networkZ ip_bracketr �str�channelr Z ReqChannel�factory�send)r r& r{ r~ r r r �_send_token_request; s � �$�z Resolver._send_token_requestc C s< i }|s t d� |S |� d�}|| jvr/t d�|�� t d�d�tdd� | jD ����� |S tjj�| j| �}|d D ](}|| j v rL| j | ||< q=|� d �r\t � |� d ��||< q=t |� d ��||< q=t |d �� �D ] \}}|| j v r| j | |d < qnt |� d |� d��||< qnd|v r�|d s�tjj�� |d< |S )zo Execute the CLI options to fill in the extra data needed for the defined eauth system z5External authentication system has not been specified�.authzBThe specified external authentication system "{}" is not availablezAvailable eauth types: {}z, c s s& � | ]}|� d �r|dd� V qdS )r� N���)�endswith)r, �kr r r � <genexpr>W s �$ z Resolver.cli.<locals>.<genexpr>r �passz: r2 r z [z]: r) )�printr r# �join�sortedr r r r$ r � startswith�getpass�input�listr4 rf �get_user)r r rE r' r �argr �defaultr r r �cliE s> ���� z Resolver.clic C s� d|d< ||d< | � |�}d|vr|S zGtjj�d��5 tjj�| jd d��}|�|d � W d � n1 s9w Y W d � W |S W d � W |S 1 sSw Y W |S tyd Y |S w ) z� Create the token from the CLI and request the correct data to authenticate via the passed authentication mechanism rW r r r+ � Z token_filezw+N) r� r r �filesZ set_umaskZfopenr �writer\ )r r r& rV Zfp_r r r � token_clip s* � �� �� ��zResolver.token_clic C s d|d< | � |�}|S )�1 Request a token from the master rW r �r� )r r& rV r r r rW � s zResolver.mk_tokenc C s" i }||d< d|d< | � |�}|S )r� r+ � get_tokenr r� )r r+ r& rV r r r r� � s zResolver.get_tokenN) ru rv rw rx r r� r� r� rW r� r r r r ry 1 s + ry c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd S ) rh zH Represents a user requesting authentication to the salt master c C s || _ dS )za Instantiate an AuthUser object. Takes a user to reprsent, as a string. N)rf )r rf r r r r � s zAuthUser.__init__c C s | j �d�S )z� Determines if the user is running with sudo Returns True if the user is running with sudo and False if the user is not running with sudo Zsudo_)rf r� r r r r ri � s zAuthUser.is_sudoc C s | j tjj �� kS )z� Determines if the user is the same user as the one running this process Returns True if the user is the same user as the one running this process and False if not. )rf r r r� r r r r rk � s zAuthUser.is_running_userc C s | j �dd�d S )zh Returns the username of the sudoer, i.e. self.user without the 'sudo_' prefix. rU � ���)rf �splitr r r r rj � s zAuthUser.sudo_nameN)ru rv rw rx r ri rk rj r r r r rh � s rh ) rx r� �loggingr@ r> �collections.abcr r Zsalt.channel.clientr Z salt.configZsalt.exceptionsZ salt.loaderZ salt.payloadZsalt.utils.argsZsalt.utils.dictupdateZsalt.utils.filesZsalt.utils.minionsZsalt.utils.networkZsalt.utils.userZsalt.utils.versions� getLoggerru r8 � frozensetr6 r ry rh r r r r �<module> s8 � d
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings