Archived
87 lines
2.7 KiB
Python
87 lines
2.7 KiB
Python
import datetime
|
|
from django.conf import settings
|
|
import logging
|
|
import re
|
|
from subprocess import Popen, PIPE
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
KADMIN_DATE_FORMAT = '%a %b %d %H:%M:%S %Z %Y'
|
|
|
|
|
|
def parse_kadmin_result(output):
|
|
return dict(re.findall(r'([\w ]*): (.+)', output))
|
|
|
|
|
|
def get_kerberos_principal(username):
|
|
principal = "{}@{}".format(username, settings.KERBEROS_REALM)
|
|
kadmin_query = " -p '{}' -w {} -q 'get_principal {}'".format(
|
|
settings.KERBEROS_ADMIN_PRINCIPAL,
|
|
settings.KERBEROS_PASSWORD,
|
|
principal)
|
|
p = Popen('kadmin' + kadmin_query, shell=True, stdout=PIPE, stderr=PIPE)
|
|
output, error = p.communicate()
|
|
if error:
|
|
# Can not init with KDC?
|
|
# KADM5_UNK_PRINC (principal does not exist)
|
|
# KADM5_AUTH_GET (requires the get (inquire) privilege)
|
|
logger.warning(error)
|
|
return None
|
|
|
|
return parse_kadmin_result(output)
|
|
|
|
|
|
def has_kerberos_principal(username):
|
|
return get_kerberos_principal(username) is not None
|
|
|
|
|
|
def set_kerberos_password(username, raw_password):
|
|
principal = "{}@{}".format(username, settings.KERBEROS_REALM)
|
|
kadmin_query = 'change_password -pw {} {}'.format(raw_password, principal)
|
|
kadmin_params = [
|
|
'-p', settings.KERBEROS_ADMIN_PRINCIPAL,
|
|
'-w', settings.KERBEROS_PASSWORD,
|
|
'-q', kadmin_query]
|
|
cmd = ['kadmin'] + kadmin_params
|
|
|
|
p = Popen(cmd, stdout=PIPE, stderr=PIPE)
|
|
output, error = p.communicate()
|
|
if error:
|
|
# Can not init with KDC?
|
|
# KADM5_AUTH_MODIFY (requires the modify privilege)
|
|
logger.warning(error)
|
|
|
|
|
|
def format_krb5_date(date):
|
|
try:
|
|
formatted_date = datetime.datetime.strptime(date, KADMIN_DATE_FORMAT)
|
|
formatted_date = formatted_date.isoformat()
|
|
except ValueError:
|
|
formatted_date = 'never'
|
|
return formatted_date
|
|
|
|
|
|
def add_kerberos_principal(username, password, dry_run=False):
|
|
principal = "{}@{}".format(username, settings.KERBEROS_REALM)
|
|
kadmin_query = " -p {} -w {} -q 'add_principal -policy default -pw {} {}'".format(
|
|
settings.KERBEROS_ADMIN_PRINCIPAL,
|
|
settings.KERBEROS_PASSWORD,
|
|
password,
|
|
principal)
|
|
|
|
if not dry_run:
|
|
p = Popen('kadmin' + kadmin_query, shell=True, stdout=PIPE, stderr=PIPE)
|
|
output, error = p.communicate()
|
|
if error:
|
|
# KADM5_AUTH_ADD (requires "add" privilege)
|
|
# KADM5_BAD_MASK (shouldn't happen)
|
|
# KADM5_DUP (principal exists already)
|
|
# KADM5_UNK_POLICY (policy does not exist)
|
|
# KADM5_PASS_Q_* (password quality violations)
|
|
logger.error(error)
|
|
return False
|
|
|
|
logger.debug('Added kerberos principal {}'.format(principal))
|
|
|
|
return True
|