3 deND@sdZddlZddlZddlZddlmZddlmZmZm Z ddl m Z m Z ddl m Z y ddlZWn,ek rdZejdkre d dYnXyddlZddlZWnek rdZdZYnXd d lmZejdkrd nd ZGdd d eZGdd d eZdS)zKerberos Authentication Plugin.N)Path)AnyOptionalTuple)InterfaceErrorProgrammingError)loggerntzwModule gssapi is required for GSSAPI authentication mechanism but was not found. Unable to authenticate with the server)BaseAuthPluginMySQLSSPIKerberosAuthPluginMySQLKerberosAuthPluginc@seZdZUdZdZedZedZe e j e edddZ e eddd Zee jjjd d d Ze eeeefd ddZde ee edddZe eee eefdddZeedddZdS)rz3Implement the MySQL Kerberos authentication plugin.authentication_kerberos_clientFN)returnc Cs\y8tjdd}t|j}|jddkr6|jdd\}}|Stjjjk rVt j SXdS)z(Get user from credentials without realm.initiate)usage@r N) gssapi CredentialsstrnamefindsplitrawmiscGSSErrorgetpassgetuser)credsuser_r#m/var/www/agendate/envp3/lib/python3.6/site-packages/mysql/connector/plugins/authentication_kerberos_client.pyget_user_from_credentialsLs  z1MySQLKerberosAuthPlugin.get_user_from_credentialscCs`tjjdtjdkr dtjn tdjd}|s + SPN string + UPN realm string length two bytes + UPN realm string Returns: tuple: With 'spn' and 'realm'. z + SPN string + UPN realm string length two bytes + UPN realm string Returns: tuple: With 'spn' and 'realm'. z)r?r@rA)r<rBrCrDrEr#r#r$rFPs    z,MySQLSSPIKerberosAuthPlugin._parse_auth_data)rGrc Cstjdd}d}|r^y|j|\}}Wn4tjk r\}ztd||WYdd}~XnXtjd|tjd|tdkstdkrtdtj tj f}|j r|j r|j ||j f}nd}|}tjd|tjd|dktj d ||t|tjd |_yZd}|jj|\}} tjd |tjd | tjd |jj| dj} tjd|jjWn4tk r}ztd||WYdd}~XnXtjd| | S)z(Prepare the first message to the server.zauth_response for sspiNzInvalid authentication data: zService Principal: %sz Realm: %szKPackage "pywin32" (Python for Win32 (pywin32) extensions) is not installed.z targetspn: %sz_auth_info is None: %sZ Negotiate) targetspnZ auth_infoZscflagsZdatarepzContext step err: %szContext step out_buf: %szContext completed?: %srz pkg_info: %sz%Unable to initiate security context: zInitial client token: %s)r r,rFr?rIrJsspiconsspirZISC_REQ_MUTUAL_AUTHZISC_REQ_DELEGATErKr5Z ClientAuthrNZSECURITY_NETWORK_DREP clientauth authorize authenticatedBufferpkg_info Exceptionr) r8rGrCrEr:rHZ _auth_inforidataout_bufrRr#r#r$rSjsL "         " z)MySQLSSPIKerberosAuthPlugin.auth_response)rTrcCsftjd||jj|\}}tjd|tjd||dj}tjd|tjd|jj||jjfS)a!Continue with the Kerberos TGT service request. With the TGT authentication service given response generate a TGT service request. This method must be invoked sequentially (in a loop) until the security context is completed and an empty response needs to be send to acknowledge the server. Args: tgt_auth_challenge: the challenge for the negotiation. Returns: tuple (bytearray TGS service request, bool True if context is completed otherwise False). ztgt_auth challenge: %szContext step err: %szContext step out_buf: %srzContext step resp: %szContext completed?: %s)r r,rlrmrorn)r8rTr:rsrVr#r#r$rWs     z)MySQLSSPIKerberosAuthPlugin.auth_continue)N)r_r`rarbrcrrdrerOrrlrfrhrrFrrSrWr#r#r#r$r Hs J)rbrr'r?pathlibrtypingrrrerrorsrrr r ImportErrorrrkrjr ZAUTHENTICATION_PLUGIN_CLASSrr r#r#r#r$s6