U
|
£ý°dßM ã @ sÜ d Z ddlZddlmZmZ ddlmZmZ ddlm Z m
|
Z
|
m Z m Z m Z ddlmZ ddlmZmZ dd lmZ dd
|
lmZ z ddlZW n ek
|
r¦ ed dY nX dd lmZmZ d dl m Z dZ G dd de Z dS )z LDAP SASL Authentication Plugin.é N)Ú b64decodeÚ b64encode)Úsha1Úsha256)ÚAnyÚCallableÚListÚOptionalÚTuple)Úuuid4é )ÚInterfaceErrorÚProgrammingError)Úlogger)Ú
|
StrOrByteszwModule gssapi is required for GSSAPI authentication mechanism but was not found. Unable to authenticate with the server)Únormalize_unicode_stringÚ"validate_normalized_unicode_stringé )ÚBaseAuthPluginÚ MySQLLdapSaslPasswordAuthPluginc @ sì e Zd ZU dZdddgZee ed< dZe ed< dZ
|
eed < e Z e ed
|
< d Zee ed < d Zeed < d Zee ed< d Zee ed< dZeed< d Zee ed< d Zeej ed< d Zej ed< d Z ee ed< d Z ee ed< e e e e dddZ!e e e ddd Z"ee ee d d d Z#e eed d!d"Z$e d#d$d%Z%ee d#d&d'Z&ee e'ee e f d(d)d*Z(e e d+d,d-Z)d?ee ee d.d/d0Z*e d#d1d2Z+e d d3d4d5Z,e e d6d7d8Z-e.e d9d:d;Z/e.e d<d=d>Z0d S )@r a5 Class implementing the MySQL ldap sasl authentication plugin.
|
|
The MySQL's ldap sasl authentication plugin support two authentication
|
methods SCRAM-SHA-1 and GSSAPI (using Kerberos). This implementation only
|
support SCRAM-SHA-1 and SCRAM-SHA-256.
|
|
SCRAM-SHA-1 amd SCRAM-SHA-256
|
This method requires 2 messages from client and 2 responses from
|
server.
|
|
The first message from client will be generated by prepare_password(),
|
after receive the response from the server, it is required that this
|
response is passed back to auth_continue() which will return the
|
second message from the client. After send this second message to the
|
server, the second server respond needs to be passed to auth_finalize()
|
to finish the authentication process.
|
z SCRAM-SHA-1z SCRAM-SHA-256ZGSSAPIÚsasl_mechanismsFÚ requires_sslZ authentication_ldap_sasl_clientÚ plugin_nameÚdef_digest_modeNÚ client_nonceÚ client_saltÚ server_saltÚkrb_service_principalr Ú
|
iterationsÚserver_auth_varÚ target_nameÚctxÚ servers_firstÚ server_nonce)Úbytes1Úbytes2Úreturnc C s t dd t| |D S )Nc S s g | ]\}}||A qS © r' )Ú.0Zb1Zb2r' r' únd:\z\workplace\vscode\pyvenv\venv\Lib\site-packages\mysql/connector/plugins/authentication_ldap_sasl_client.pyÚ
|
<listcomp>a s z8MySQLLdapSaslPasswordAuthPlugin._xor.<locals>.<listcomp>)ÚbytesÚzip)r$ r% r' r' r) Ú_xor_ s z$MySQLLdapSaslPasswordAuthPlugin._xor)ÚpasswordÚsaltr& c C s t ||| j¡}| ¡ S )N)ÚhmacÚnewr Údigest)Úselfr. r/ Z digest_makerr' r' r) Ú_hmacc s z%MySQLLdapSaslPasswordAuthPlugin._hmac)r. r/ Úcountr& c C sJ | ¡ }| ||d ¡}|}t|d D ] }| ||¡}| ||¡}q(|S )zPrepares Hi
|
Hi(password, salt, iterations) where Hi(p,s,i) is defined as
|
PBKDF2 (HMAC, p, s, i, output length of H).
|
s r )Úencoder4 Úranger- )r3 r. r/ r5 ÚpwÚhiZauxÚ_r' r' r) Ú_hig s z#MySQLLdapSaslPasswordAuthPlugin._hi)Ústringr& c C s* t | }t|}|d k r&td| |S )Nz broken_rule: )Ú norm_ustrÚ
|
valid_normr )r< Znorm_strZ broken_ruler' r' r) Ú
|
_normalizet s
|
z*MySQLLdapSaslPasswordAuthPlugin._normalize)r& c C sH d}t t dd¡| _|j| | j¡| jd}t|t rD| d¡}|S )aq This method generates the first message to the server to start the
|
|
The client-first message consists of a gs2-header,
|
the desired username, and a randomly generated client nonce cnonce.
|
|
The first message from the server has the form:
|
b'n,a=<user_name>,n=<user_name>,r=<client_nonce>
|
|
Returns client's first message
|
z.n,a={user_name},n={user_name},r={client_nonce}ú-Ú )Ú user_namer Úutf8) Ústrr Úreplacer Úformatr? Ú _usernameÚ
|
isinstancer6 )r3 Z
|
cfm_fprnatZcfmr' r' r) Ú_first_message| s
|
þ
|
|
z.MySQLLdapSaslPasswordAuthPlugin._first_messagec
|
C sü t jjj| j d¡t jjd}zpt ¡ }t
|
d¡ z
|
|j W nN t jj j k
|
r } z*t d|¡ | |¡ td| |W 5 d}~X Y nX W n¬ t jjjk
|
r: } z| js¾td| |z0t
|
d¡ t jj|| j d¡d d
|
}|d }W n: t jjjk
|
r( } ztd | |W 5 d}~X Y nX W 5 d}~X Y nX t jjt jjt jjf}| jrb| j}nd }t
|
d|¡ t j|t jj d}|| _ t j ||t |d d| _ z| j !¡ } W n: t jjjk
|
rê } ztd| |W 5 d}~X Y nX t
|
d| ¡ | S )zGet a TGT Authentication request and initiates security context.
|
|
This method will contact the Kerberos KDC in order of obtain a TGT.
|
rC )Z name_typezE# Stored credentials found, if password was given it will be ignored.z Credentials has expired: %szCredentials has expired: Nz-Unable to retrieve stored credentials error: z5# Attempt to retrieve credentials with given passwordZinitiate)Úusager z8Unable to retrieve credentials with the given password: z ldap/ldapauthz# service principal: %s)ÚnameÚcredsÚflagsrJ z%Unable to initiate security context: z# initial client token: %s)"ÚgssapiÚrawÚnamesÚ import_namerG r6 ZNameTypeÚuserZ Credentialsr ÚdebugZlifetimeÚ
|
exceptionsZExpiredCredentialsErrorÚwarningÚacquirer ÚmiscZGSSErrorÚ _passwordZacquire_cred_with_passwordr ZRequirementFlagZmutual_authenticationZextended_errorZdelegate_to_peerr ÚNameZkerberos_principalr ÚSecurityContextÚsumr! Ústep)
|
r3 rB ÚcredÚerrZacquire_cred_resultZerr2Zflags_lZservice_principalZservkZinitial_client_tokenr' r' r) Ú_first_message_krb sz
|
ÿÿ
|
|
&ÿþ
|
|
ý ÿþ&ý ÿ ÿ" z2MySQLLdapSaslPasswordAuthPlugin._first_message_krb)Útgt_auth_challenger& c C s@ t d|¡ | j |¡}t d|¡ t d| jj¡ || jjfS )a Continue with the Kerberos TGT service request.
|
|
With the TGT authentication service given response generate a TGT
|
service request. This method must be invoked sequentially (in a loop)
|
until the security context is completed and an empty response needs to
|
be send to acknowledge the server.
|
|
Args:
|
tgt_auth_challenge the challenge for the negotiation.
|
|
Returns: tuple (bytearray TGS service request,
|
bool True if context is completed otherwise False).
|
ztgt_auth challenge: %sz# context step response: %sz# context completed?: %s)r rS r! r\ Úcomplete)r3 r` Úrespr' r' r) Úauth_continue_krbÛ s
|
z1MySQLLdapSaslPasswordAuthPlugin.auth_continue_krb)Úmessager& c
|
C sÒ | j jstdt d|¡ t d| j j¡ z | j |¡}t d|¡ W n8 tjj j
|
k
|
r } zt d| |W 5 d}~X Y nX t d|¡ t d}t d |¡ | j j |d
|
d }t d |d t|d ¡ |jS )aP Accept handshake and generate closing handshake message for server.
|
|
This method verifies the server authenticity from the given message
|
and included signature and generates the closing handshake for the
|
server.
|
|
When this method is invoked the security context is already established
|
and the client and server can send GSSAPI formated secure messages.
|
|
To finish the authentication handshake the server sends a message
|
with the security layer availability and the maximum buffer size.
|
|
Since the connector only uses the GSSAPI authentication mechanism to
|
authenticate the user with the server, the server will verify clients
|
message signature and terminate the GSSAPI authentication and send two
|
messages; an authentication acceptance b' ' and a
|
OK packet (that must be received after sent the returned message from
|
this method).
|
|
Args:
|
message a wrapped hssapi message from the server.
|
|
Returns: bytearray closing handshake message to be send to the server.
|
z"Security context is not completed.z# servers message: %sz# GSSAPI flags in use: %sz# unwraped: %sz!Unable to unwrap server message: Nz # unwrapped server message: %ss z# message response: %sF)Zencryptz*# wrapped message response: %s, length: %dr )r! ra r r rS Z actual_flagsÚunwraprN rO rT Z BadMICErrorr Ú bytearrayÚwrapÚlenrd )r3 rd Zunwrapedr^ ÚresponseZwrapedr' r' r) Úauth_accept_close_handshakeó s& "
|
ýz;MySQLLdapSaslPasswordAuthPlugin.auth_accept_close_handshake)Ú auth_datar& c C s |}| j ¡ }|| _t d|¡ || jkr`d | jdd
¡}td| d| d| jd dd | j krr| ¡ S | j d
|
krt | _
|
| ¡ S ) zThis method will prepare the fist message to the server.
|
|
Returns bytes to send to the server as the first message.
|
z read_method_name_from_server: %sz", "Néÿÿÿÿz The sasl authentication method "z4" requested from the server is not supported. Only "z" and "z" are supporteds GSSAPIs SCRAM-SHA-256) Ú
|
_auth_dataÚdecoder r rS r Újoinr r_ r r rI )r3 rk r Zauth_mechanismZauth_mechanismsr' r' r) Ú auth_response' s
|
|
ÿ
|
|
z-MySQLLdapSaslPasswordAuthPlugin.auth_responsec C sÐ | j std| | j¡}| |t| j| j¡}t dt
|
| ¡ ¡ | |d¡}t dt
|
| ¡ ¡ | |¡ ¡ }t dt
|
| ¡ ¡ | |d¡}t dt
|
| ¡ ¡ d d | | j¡ d
|
| j g¡}t d |¡ t
|
d | | j¡ d ¡ ¡ }d || jd | d
|
| j g¡}t d|¡ | || ¡ ¡} t dt
|
| ¡ ¡ | || ¡}
|
t dt
|
|
|
¡ ¡ t
|
| || ¡ ¡ ¡ | _t d| j¡ d d | d
|
| j dt
|
|
|
¡ g¡} t d| ¡ | ¡ S )a¥ This method generates the second message to the server
|
|
Second message consist on the concatenation of the client and the
|
server nonce, and cproof.
|
|
c=<n,a=<user_name>>,r=<server_nonce>,p=<client_proof>
|
where:
|
<client_proof>: xor(<client_key>, <client_signature>)
|
|
<client_key>: hmac(salted_password, b"Client Key")
|
<client_signature>: hmac(<stored_key>, <auth_msg>)
|
<stored_key>: h(<client_key>)
|
<auth_msg>: <client_first_no_header>,<servers_first>,
|
c=<client_header>,r=<server_nonce>
|
<client_first_no_header>: n=<username>r=<client_nonce>
|
z"Missing authentication data (seed)zsalted_password: %ss
|
Client Keyzclient_key: %szstored_key: %ss
|
Server Keyzserver_key: %sú,zn=úr=zclient_first_no_header: %szn,a=zc=z auth_msg: %szclient_signature: %szclient_proof: %szserver_auth_var: %szp=zsecond_message: %s)rm r r? rX r; r r r r rS r rn r4 r r2 ro rG r r6 r" r# r- r ) r3 ZpasswZsalted_passwordZ
|
client_keyZ
|
stored_keyZ
|
server_keyZclient_first_no_headerZ client_headerZauth_msgZclient_signatureZ client_proofÚmsgr' r' r) Ú_second_messageC sX
|
þÿ ÿ
|
üÿ ÿ
|
|
ýÿ z/MySQLLdapSaslPasswordAuthPlugin._second_message)r" r& c
|
C sR |rt |ttfs$tdt| z"| ¡ }|| _| d¡\}}}W n$ tk
|
rj td| dY nX | d¡r| d¡r| d¡std| | j
|
|krÀ|dd
| _ t d | j ¡ ntd
|
| |dd
| _t d | jt| j¡ z&|dd
}t d |¡ t|| _W n4 tk
|
rL } ztd | |W 5 d}~X Y nX dS )zâValidates first message from the server.
|
|
Extracts the server's salt and iterations from the servers 1st response.
|
First message from the server is in the form:
|
<server_salt>,i=<iterations>
|
zUnexpected server message: rq Nrr zs=zi=z$Incomplete reponse from the server: r zserver_nonce: %sz:Unable to authenticate response: response not well formed zserver_salt: %s length: %sziterations: %sz-Unable to authenticate: iterations not found )rH rf r+ r Úreprrn r" ÚsplitÚ
|
ValueErrorÚ
|
startswithr r# r rS r rh Úintr Ú Exception)r3 r" Zservers_first_strZr_server_nonceZs_saltZ i_counterr^ r' r' r) Ú_validate_first_reponse sV ÿþÿþýÿ
|
ÿý ÿþz7MySQLLdapSaslPasswordAuthPlugin._validate_first_reponse)Úservers_first_responser& c C s | |¡ | ¡ S )zwreturn the second message from the client.
|
|
Returns bytes to send to the server as the second message.
|
)r{ rt )r3 r| r' r' r) Ú auth_continue¿ s
|
z-MySQLLdapSaslPasswordAuthPlugin.auth_continue)Úservers_secondr& c C sR |r$t |tr$t|dks$| d¡s,td|dd
¡ }t d|¡ | j|kS )aX Validates second message from the server.
|
|
The client and the server prove to each other they have the same Auth
|
variable.
|
|
The second message from the server consist of the server's proof:
|
server_proof = HMAC(<server_key>, <auth_msg>)
|
where:
|
<server_key>: hmac(<salted_password>, b"Server Key")
|
<auth_msg>: <client_first_no_header>,<servers_first>,
|
c=<client_header>,r=<server_nonce>
|
|
Our server_proof must be equal to the Auth variable send on this second
|
response.
|
r s v=z'The server's proof is not well formatedNzserver auth variable: %s) rH rf rh rx r rn r rS r )r3 r~ Z
|
server_varr' r' r) Ú_validate_second_reponseÇ s ÿþ
|
ýü z8MySQLLdapSaslPasswordAuthPlugin._validate_second_reponse)Úservers_second_responser& c C s | |¡stddS )zºfinalize the authentication process.
|
|
Raises InterfaceError if the ervers_second_response is invalid.
|
|
Returns True in successful authentication False otherwise.
|
z6Authentication failed: Unable to proof server identityT)r r )r3 r r' r' r) Ú auth_finalizeâ s
|
|
ÿz-MySQLLdapSaslPasswordAuthPlugin.auth_finalize)N)1Ú__name__Ú
|
__module__Ú __qualname__Ú__doc__r r rD Ú__annotations__r Úboolr r r r r r r r r r r r ry r r rN rY r! rZ r" r# Ú staticmethodr+ r- r4 r; r? rI r_ r
|
rc rj rp rt r{ r} rf r r r' r' r' r) r = sJ
|
Jþ 6 þý L0)!r
r0 Úbase64r r Úhashlibr r Útypingr r r r r
|
Úuuidr Úerrorsr r r Útypesr rN Ú ImportErrorÚutilsr r= r r> rA r ZAUTHENTICATION_PLUGIN_CLASSr r' r' r' r) Ú<module> s( ÿü
|
