File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/__pycache__/__init__.cpython-310.pyc
o
;j�] � @ s� d Z ddlZddlZddlZddlZddlmZmZ ddlZ ddl
Z ddl Z ddl Z ddl
Z ddlZ ddlZ ddlZ ddlZ ddlZ ddlZ ddlZ e�e�Zeg d��ZG dd� d�ZG dd� d�ZG d d
� d
�Z dS ) z�
Salt's pluggable authentication system
This system allows for authentication to be managed in a module pluggable way
so that any external authentication system can be used inside of Salt
� N)�Iterable�Mapping) �client�cmd�eauthZfunZgather_job_timeout�kwarg�match�metadataZ print_event�rawZyield_pub_datac @ s� e Zd ZdZd,dd�Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zd%d&� Zd,d'd(�Zd-d*d+�ZdS ).�LoadAuthzH
Wrap the authentication system to handle peripheral components
Nc C s@ || _ d| _tj�|�| _tj�|�| _|p tjj� |�| _
d S )Ng �?) �opts�max_fail�salt�loader�auth� eauth_tokens�tokens�utilsZminionsZ CkMinions� ckminions)�selfr r � r �F/opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/__init__.py�__init__: s
zLoadAuth.__init__c C s� t | d�r| jdurt | jd�r| j�� i | _t | d�r0| jdur0t | jd�r-| j�� i | _t | d�r\| jdur^t | jd�rW| jjdurWt | jjd�rS| jj�� d| j_d| _dS dS dS )z$
Clean up resources
r N�destroyr r �cache)�hasattrr r r r r �r r r r r A s
�zLoadAuth.destroyc C s | S �Nr r r r r � __enter__T s zLoadAuth.__enter__c G s | � � d S r )r )r �argsr r r �__exit__W s zLoadAuth.__exit__c C sd d|vrdS d� |d �}|| jvrdS ztjj�| j| �d d }|| W S ty1 Y dS w )z�
Return the primary name associate with the load, if an empty string
is returned then the load does not match the function
r � �{}.authr r )�formatr r r r �
arg_lookup�
IndexError)r �load�fstrZ pname_argr r r � load_nameZ s
�zLoadAuth.load_namec
s� d|vrdS d� |d �}|| jvrdS g d�� � fdd�|�� D �}tjjj| j| |td�}z d|v rD| j| |d i |d ��W S | j| |d � W S tyf } z
t �
d
|� W Y d }~dS d }~ww ) z�
Return the token and set the cache data for use
Do not call this directly! Use the time_auth method to overcome timing
attacks
r Fr" )�username�passwordr �tokenc s i | ] \}}|� v r||�qS r r )�.0�key�value�Z_validr r �
<dictcomp>y s z(LoadAuth.__auth_call.<locals>.<dictcomp>�Zexpected_extra_kws�kwargsr � Authentication module threw %sN) r# r �itemsr r r � format_call�AUTH_INTERNAL_KEYWORDS� Exception�log�debug)r r& r' �_load�fcall�er r/ r Z __auth_callj s&
� ��zLoadAuth.__auth_callc C s� t � � }| �|�}|r
|S t � � | }|| jkr|| _| jd }t�� �| j| | j| �}|| t � � krCt �d� || t � � ks6dS )zO
Make sure that all failures happen in the same amount of time
� g����MbP?F)�time�_LoadAuth__auth_callr
�random� SystemRandom�uniform�sleep)r r& �start�retZf_timeZ deviationZr_timer r r � time_auth� s
�
�zLoadAuth.time_authc
C s� d|vrdS | j d }|s|d }|� d�}|| jvr dS tjjj| j| |td�}z| j| |d i |d ��W S tyR } z
t� d|� W Y d}~dS d}~ww ) z�
Returns ACL for a specific user.
Returns None if eauth doesn't provide any for the user. I. e. None means: use acl declared
in master config.
r NZeauth_acl_modulez.aclr1 r r2 r3 )
r r r r r r5 r6 r7 r8 r9 )r r& �modr' r; r< r r r Z __get_acl� s$
� ��zLoadAuth.__get_aclc
C sr d|vr|S d� |d �}|| jvr|S z
| j| || j�W S ty8 } zt�d|� |W Y d}~S d}~ww )z�
Allows eauth module to modify the access list right before it'll be applied to the request.
For example ldap auth module expands entries
r z{}.process_aclr3 N)r# r r r7 r8 r9 )r r& � auth_listr' r< r r r Z
__process_acl� s
��zLoadAuth.__process_aclc C s� d|vrdS d� |d �}|| jvrdS tjjj| j| |td�}z| j| |d i |d ��W S ty: Y dS tyC Y dS w )zw
Read in a load and return the groups a user is a member of
by asking the appropriate provider
r Fz {}.groupsr1 r r2 N) r# r r r r r5 r6 r% r7 )r r& r' r; r r r �
get_groups� s
� �zLoadAuth.get_groupsc C sT | j �dd�}|du r
dS t|t�r(|�|d g �}t|t�r(|�d�|v r(dS dS )zP
Return bool if requesting user is allowed to set custom expire
Ztoken_expire_user_overrideFTr r) )r �get�
isinstancer r )r r& Zexpire_overrideZexpire_whitelistr r r �_allow_custom_expire� s
z LoadAuth._allow_custom_expirec C s� | � |�si S | �|�r|�d| jd �}n |�dd�}| jd }t�� t�� | | �|�|d d�}| jd rA| �|�}||d< | �|�}|rL||d< | jd� | jd � | j|�S )
zM
Run time_auth and create a token. Return False or the token
� token_expireNr )rD �expire�namer �keep_acl_in_tokenrH �groupsz {}.mk_tokenr )
�authenticate_eauthrL �popr r> r( �_LoadAuth__get_aclrI r r# )r r& rM �_�tdataZacl_retrQ r r r �mk_token� s(
�
�zLoadAuth.mk_tokenc
C s� z| j d�| jd � | j|�}W nJ tjjy: } zt�d||� tjddd� | � |� i W Y d}~S d}~w t
y[ } zt�d||� tjd dd� i W Y d}~S d}~ww |s`i S |� d
d �t � � k rq| � |� i S |S ) zg
Return the name associated with the token, or False if the token is
not valid
z {}.get_tokenr zDToken %r could not be deserialized (%r); removing it from the store.z Token deserialization traceback:T)�exc_infoNz�Token store transient error reading %r (%r); treating as not-authenticated for this request without removing the token from the store.z&Token store transient-error traceback:rN r )
r r# r r �
exceptionsZSaltDeserializationErrorr8 �warningr9 �rm_token�OSErrorrJ r> )r �tokrV �excr r r �get_tok s< � �
�
���
zLoadAuth.get_tokc C s | j d�| jd � | j�S )z8
List all tokens in eauth_tokn storage.
z{}.list_tokensr �r r# r r r r r � list_tokens@ s �zLoadAuth.list_tokensc C s" | j d�| jd � | j|� dS )z<
Remove the given token from token storage.
z {}.rm_tokenr Nr` )r r] r r r r[ H s "zLoadAuth.rm_tokenc C s6 | � |d �}|r|d | jd vrt�d� dS |S )z~
Authenticate a user by the token specified in load.
Return the token object or False if auth failed.
r+ r �
external_auth�0Authentication failure of type "token" occurred.F)r_ r r8 rZ )r r& r+ r r r �authenticate_tokenN s
zLoadAuth.authenticate_tokenc C sb d|vr t �d� dS |d | jd vr#t �d|d � t �d� dS | �|�s/t �d� dS dS )z�
Authenticate a user by the external auth module specified in load.
Return True on success or False on failure.
r z0Authentication failure of type "eauth" occurred.Frb �$The eauth system "%s" is not enabledT)r8 rZ r rF )r r& r r r rR \ s
zLoadAuth.authenticate_eauthc C s� d}|� dd�}|du rt�|� dS d|v r�t|d �}|�� r4|D ]}||| kr1|�� S q#dS |d | j�dd�ksE|d dkrh|D ] }||| krR dS qGt�d| j�dd�|d � t�|� dS |�� r~||�|d �kr|t�|� dS dS ||�d�kr� dS ||�d �kr� dS |d |v r�|||d kr�t�|� dS |d S t�|� dS |D ] }||| kr� dS q�t�|� dS )
a
Authenticate a user by the key passed in load.
Return the effective user id (name) if it's different from the specified one (for sudo).
If the effective user id is the same as the passed one, return True on success or False on
failure.
z/Authentication failure of type "user" occurred.r- NF�user�rootTz,Master runs as %r, but user in payload is %rr ) rS r8 rZ �AuthUser�is_sudo� sudo_namer rJ �is_running_user)r r& r- Z error_msgZauth_keyZ auth_userZ check_keyr r r �authenticate_keyr sb
�" � �
�� �
�
zLoadAuth.authenticate_keyc C s� |r| j d rd|v r|d S | �|�}|dur|S |r |d n|d }|| j d vr8t�d|� t�d� dS |rD|d }|�d �}n
| �|�}| �|�}| j d | }|s]t�d
|� |sag }| j� |||�}| �
||�}t� d |� |S ) a�
Retrieve access list for the user specified in load.
The list is built by eauth module or from master eauth configuration.
Return None if current configuration doesn't provide any ACL for the user. Return an empty
list if the user has no rights to execute anything on this master and returns non-empty list
if user is allowed to execute particular functions.
rP rH Nr rb re z Authorization failure occurred.rO rQ z!eauth "%s" configuration is emptyzCompiled auth_list: %s) r rT r8 r9 rZ rJ r( rI r Zfill_auth_list�_LoadAuth__process_aclZtrace)r r& r+ rH r rO rQ Z eauth_configr r r �
get_auth_list� s0
zLoadAuth.get_auth_listFc C sh g }|� dd�}||i d�}|dkr2| �|�}|s"ddd�|d< |S |d }||d< | j||d
�}n||d krM| �|�sGd d
�|�d�|d< |S | �|�}na|dkr�| �||�} d}
| sn|re|
� d|� d�}
d|
d�|d< |S | dur�t|d ��� r�| jd r�| jd s�d} | dur�ddl } | j
j � | jd | �}|s�d|
d�|d< |S n ddd�|d< |S ||d< |S )a�
.. versionadded:: 2018.3.0
Go through various checks to see if the token/eauth/user can be authenticated.
Returns a dictionary containing the following keys:
- auth_list
- username
- error
If an error is encountered, return immediately with the relevant error dictionary
as authentication has failed. Otherwise, return the username and valid auth_list.
r) �UNKNOWN)rH r) �errorr+ ZTokenAuthenticationErrorrc )rO �messagerp rO )r+ r ZEauthAuthenticationErrorz<Authentication failure of type "eauth" occurred for user {}.rf z.Authentication failure of type "user" occurredz
for user �.ZUserAuthenticationErrorTZsudo_aclZ
publisher_aclr NZSaltInvocationErrorz"Authentication type not supported.rH )
rJ rd rn rR r# rl rh ri r Zsalt.utils.masterr ZmasterZget_values_of_matching_keys) r r& Z auth_typer- Z
show_usernamerH r) rE r+ Zauth_ret�msgr r r r �check_authentication� sb
�
�
�
��
�z LoadAuth.check_authenticationr )NF)�__name__�
__module__� __qualname__�__doc__r r r r r( r? rF rT rm rI rL rW r_ ra r[ rd rR rl rn rt r r r r r 5 s,
:
@.r c @ s@ e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
d � Zd d
� Z dS )�Resolverzk
The class used to resolve options for the command line and for generic
interactive interfaces
c C s || _ tj�|�| _d S r )r r r r )r r r r r r 7 s zResolver.__init__c C sl d� tjj�| jd �t| jd ��}tjjj j
| jd|d��
}|� |�W d � S 1 s/w Y d S )Nz tcp://{}:{}Z interfaceZret_port�clear)Zcrypt�
master_uri) r# r r �networkZ
ip_bracketr �str�channelr Z
ReqChannel�factory�send)r r& r{ r~ r r r �_send_token_request; s �
�$�z Resolver._send_token_requestc C s< i }|s
t d� |S |� d�}|| jvr/t d�|�� t d�d�tdd� | jD ����� |S tjj�| j| �}|d D ](}|| j v rL| j | ||< q=|�
d �r\t � |� d
��||< q=t |� d
��||< q=t
|d �� �D ] \}}|| j v r| j | |d < qnt |� d
|� d��||< qnd|v r�|d s�tjj�� |d< |S )zo
Execute the CLI options to fill in the extra data needed for the
defined eauth system
z5External authentication system has not been specified�.authzBThe specified external authentication system "{}" is not availablezAvailable eauth types: {}z, c s s& � | ]}|� d �r|dd� V qdS )r� N���)�endswith)r, �kr r r � <genexpr>W s �$ z Resolver.cli.<locals>.<genexpr>r �passz: r2 r z [z]: r) )�printr r# �join�sortedr r r r$ r �
startswith�getpass�input�listr4 rf �get_user)r r rE r' r �argr �defaultr r r �cliE s>
����
z Resolver.clic C s� d|d< ||d< | � |�}d|vr|S zGtjj�d��5 tjj�| jd d��}|�|d � W d � n1 s9w Y W d � W |S W d � W |S 1 sSw Y W |S tyd Y |S w ) z�
Create the token from the CLI and request the correct data to
authenticate via the passed authentication mechanism
rW r r r+ � Z
token_filezw+N) r� r r �filesZ set_umaskZfopenr �writer\ )r r r& rV Zfp_r r r � token_clip s*
� �� �� ��zResolver.token_clic C s d|d< | � |�}|S )�1
Request a token from the master
rW r �r� )r r& rV r r r rW � s
zResolver.mk_tokenc C s" i }||d< d|d< | � |�}|S )r� r+ � get_tokenr r� )r r+ r& rV r r r r� � s
zResolver.get_tokenN)
ru rv rw rx r r� r� r� rW r� r r r r ry 1 s
+ ry c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
S ) rh zH
Represents a user requesting authentication to the salt master
c C s
|| _ dS )za
Instantiate an AuthUser object.
Takes a user to reprsent, as a string.
N)rf )r rf r r r r � s
zAuthUser.__init__c C s | j �d�S )z�
Determines if the user is running with sudo
Returns True if the user is running with sudo and False if the
user is not running with sudo
Zsudo_)rf r� r r r r ri � s zAuthUser.is_sudoc C s | j tjj �� kS )z�
Determines if the user is the same user as the one running
this process
Returns True if the user is the same user as the one running
this process and False if not.
)rf r r r� r r r r rk � s zAuthUser.is_running_userc C s | j �dd�d S )zh
Returns the username of the sudoer, i.e. self.user without the
'sudo_' prefix.
rU � ���)rf �splitr r r r rj � s zAuthUser.sudo_nameN)ru rv rw rx r ri rk rj r r r r rh � s
rh ) rx r� �loggingr@ r> �collections.abcr r Zsalt.channel.clientr Z salt.configZsalt.exceptionsZ salt.loaderZ salt.payloadZsalt.utils.argsZsalt.utils.dictupdateZsalt.utils.filesZsalt.utils.minionsZsalt.utils.networkZsalt.utils.userZsalt.utils.versions� getLoggerru r8 � frozensetr6 r ry rh r r r r �<module> s8
� d