Package pyxmpp :: Package sasl :: Module gssapi

[hide private]

# Source Code for Module pyxmpp.sasl.gssapi

     1  #
     2  # (C) Copyright 2008 Jelmer Vernooij <jelmer@samba.org>
     3  #
     4  # This program is free software; you can redistribute it and/or modify
     5  # it under the terms of the GNU Lesser General Public License Version
     6  # 2.1 as published by the Free Software Foundation.
     7  #
     8  # This program is distributed in the hope that it will be useful,
     9  # but WITHOUT ANY WARRANTY; without even the implied warranty of
    10  # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    11  # GNU Lesser General Public License for more details.
    12  #
    13  # You should have received a copy of the GNU Lesser General Public
    14  # License along with this program; if not, write to the Free Software
    15  # Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
    16  #
    17  """GSSAPI authentication mechanism for PyXMPP SASL implementation.
    18
    19  Normative reference:
    20    - `RFC 4752 <http://www.ietf.org/rfc/rfc4752.txt>`__
    21  """
    22
    23  __revision__="$Id$"
    24  __docformat__="restructuredtext en"
    25
    26  import base64
    27  import kerberos
    28
    29  import logging
    30
    31  from pyxmpp.sasl.core import (ClientAuthenticator,Failure,Response,Challenge,Success)
    32
    33 -class GSSAPIClientAuthenticator(ClientAuthenticator):
    34      """Provides client-side GSSAPI SASL (Kerberos 5) authentication."""
    35
    36 -    def __init__(self,password_manager):
    37          ClientAuthenticator.__init__(self, password_manager)
    38          self.password_manager = password_manager
    39          self.__logger = logging.getLogger("pyxmpp.sasl.gssapi.GSSAPIClientAuthenticator")
    40
    41 -    def start(self, username, authzid):
    42          self.username = username
    43          self.authzid = authzid
    44          rc, self._gss = kerberos.authGSSClientInit(authzid or "%s@%s" % ("xmpp", self.password_manager.get_serv_host()))
    45          self.step = 0
    46          return self.challenge("")
    47
    48 -    def challenge(self, challenge):
    49          if self.step == 0:
    50              rc = kerberos.authGSSClientStep(self._gss, base64.b64encode(challenge))
    51              if rc != kerberos.AUTH_GSS_CONTINUE:
    52                  self.step = 1
    53          elif self.step == 1:
    54              rc = kerberos.authGSSClientUnwrap(self._gss, base64.b64encode(challenge))
    55              response = kerberos.authGSSClientResponse(self._gss)
    56              rc = kerberos.authGSSClientWrap(self._gss, response, self.username)
    57          response = kerberos.authGSSClientResponse(self._gss)
    58          if response is None:
    59              return Response("")
    60          else:
    61              return Response(base64.b64decode(response))
    62
    63 -    def finish(self, data):
    64          self.username = kerberos.authGSSClientUserName(self._gss)
    65          self.__logger.debug("Authenticated as %s" % kerberos.authGSSClientUserName(self._gss))
    66          return Success(self.username,None,self.authzid)
    67
    68
    69  # vi: sts=4 et sw=4
    70