HEX

File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/__pycache__/pki.cpython-310.pyc
o

;j5�@s�dZddlZddlZddlZz6z
ddlmZdZWn'ey@dZzddl	m
Z
Wney9ddlm
Z
YnwddlZYnwdZ
WneyOdZ
Ynwe�e�Zdd�Zd	d
�ZdS)az
Authenticate via a PKI certificate.

.. note::

    This module is Experimental and should be used with caution

Provides an authenticate function that will allow the caller to authenticate
a user via their public cert against a pre-defined Certificate Authority.

TODO: Add a 'ca_dir' option to configure a directory of CA files, a la Apache.

:depends:    - pyOpenSSL module
�N)�X509TF)�asn1cCstrdSdS)z/
    Requires newer pycrypto and pyOpenSSL
    TF)�HAS_DEPS�rr�A/opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/pki.py�__virtual__,src	Ks�tjj�dd�|}tdd�}t�d�t�d|�t�d|�trHt�	|tj
�}t�|tj
�}|�|�
��r@t�d|�d	St�d
|�dStj}|�|j|�}tjj�|��}|�|j|���}Wd�n1smwY|��}	|�|j|�}
t��}|�|
�|d
}|d}
t��}|�|
�|j}|d
dkr�td��|dd�}z!|�||||	�t|� ��!��d|ks�Jd��t�d|�Wd	Stjj"t#fy�t�d
|�YdSw)a�
    Returns True if the given user cert (password is the cert contents)
    was issued by the CA and if cert's Common Name is equal to username.

    Returns False otherwise.

    ``username``: we need it to run the auth function from CLI/API;
                  it should be in master config auth/acl
    ``password``: contents of user certificate (pem-encoded user public key);
                  why "password"? For CLI, it's the only available name

    Configure the CA cert in the master config file:

    .. code-block:: yaml

        external_auth:
          pki:
            ca_file: /etc/pki/tls/ca_certs/trusted-ca.crt
            your_user:
              - .*
    ZArgonz>This module has been deprecated as it is known to be insecure.z
config.getzexternal_auth:pki:ca_filez#Attempting to authenticate via pki.zUsing CA file: %szCertificate contents: %sz*Successfully authenticated certificate: %sTz&Failed to authenticate certificate: %sFNr��z Number of unused bits is strange�ZCNz*Certificate's CN should match the username)$�salt�utilsZversionsZ
warn_untilZ__salt__�log�debug�HAS_M2rZload_cert_stringZ
FORMAT_PEMZ	load_certZverifyZ
get_pubkey�info�OpenSSLZcryptoZload_certificateZFILETYPE_PEM�filesZfopen�readZget_signature_algorithmZdump_certificateZ
FILETYPE_ASN1rZDerSequence�decodeZ	DerObject�payload�	Exception�dictZget_subjectZget_components�Error�AssertionError)�username�password�kwargsZpemZcacert_file�certZcacert�c�fZalgoZ	cert_asn1ZderZder_certZder_sigZ
der_sig_inZsig0�sigrrr�auth5sZ�
�

��r!)�__doc__�loggingZsalt.utils.filesrZsalt.utils.versionsZM2Cryptorr�ImportErrorZCryptodome.UtilrZCrypto.Utilrr�	getLogger�__name__r
rr!rrrr�<module>s0���