r5486 - in trunk/cumin: bin etc python/cumin

croberts at fedoraproject.org croberts at fedoraproject.org
Fri Sep 28 15:10:35 UTC 2012


Author: croberts
Date: 2012-09-28 15:10:33 +0000 (Fri, 28 Sep 2012)
New Revision: 5486

Added:
   trunk/cumin/python/cumin/kerbauth.py
Modified:
   trunk/cumin/bin/cumin-web
   trunk/cumin/etc/cumin.conf
   trunk/cumin/python/cumin/authenticator.py
   trunk/cumin/python/cumin/config.py
Log:
BZ 799129:  Enabling kerberos authentication.  Using python-kerberos library to perform authentication against configured kerberos_server and kerberos_realm.

Modified: trunk/cumin/bin/cumin-web
===================================================================
--- trunk/cumin/bin/cumin-web	2012-09-27 19:35:54 UTC (rev 5485)
+++ trunk/cumin/bin/cumin-web	2012-09-28 15:10:33 UTC (rev 5486)
@@ -70,6 +70,10 @@
     cumin.ldap_tls_cacertdir = values.ldap_tls_cacertdir
     cumin.ldap_tls_cacertfile = values.ldap_tls_cacertfile
 
+def set_kerberos_configs(cumin, values):
+    cumin.kerberos_server = values.kerberos_server
+    cumin.kerberos_realm = values.kerberos_realm
+    
 def check_cert_files(opts):
     # If a certificate or key file has been specified,
     # check to make sure that both exist and that the
@@ -214,6 +218,7 @@
         set_aviary_configs(cumin, values)
         set_wallaby_configs(cumin, values, broker_uris)
         set_ldap_configs(cumin, values)
+        set_kerberos_configs(cumin, values)
 
         # Not used right now
         #cumin.auth_create_ondemand = values.auth_create_ondemand

Modified: trunk/cumin/etc/cumin.conf
===================================================================
--- trunk/cumin/etc/cumin.conf	2012-09-27 19:35:54 UTC (rev 5485)
+++ trunk/cumin/etc/cumin.conf	2012-09-28 15:10:33 UTC (rev 5486)
@@ -120,6 +120,8 @@
 # ldap_tls_cacertfile:
 # ldap_tls_cacertdir:
 # ldap_timeout: 30
+# kerberos_server: 
+# kerberos_realm: 
 
 #notification-timeout: 180
 # Number of seconds that a message in the yellow notification banner 
@@ -352,6 +354,17 @@
 ## ldap_timeout: 30
 ## Timeout in seconds for connections to an LDAP server
 
+## kerberos_server:
+## setting this [in addition to auth:kerb and kerberos_realm] will activate 
+## kerberos authentication for cumin.  The kerberos_server string should
+## be either the IP address or FQDN of the kerberos_server.
+
+## kerberos_realm:
+## setting this [in addition to auth:kerb and kerberos_server] will activate
+## kerberos authentication for cumin.  This should be set to the realm
+## defined by your kerberos server. Typically, this value will be in all caps
+## and look like "EXAMPLE.COM"
+
 ## [data]
 
 ## log-file:

Modified: trunk/cumin/python/cumin/authenticator.py
===================================================================
--- trunk/cumin/python/cumin/authenticator.py	2012-09-27 19:35:54 UTC (rev 5485)
+++ trunk/cumin/python/cumin/authenticator.py	2012-09-28 15:10:33 UTC (rev 5486)
@@ -10,6 +10,7 @@
 from subprocess import PIPE
 from psycopg2 import IntegrityError
 import syslog
+from kerbauth import CuminAuthenticatorKerberos
 
 # Send sensitive authentication logs to syslog
 # but use this for other stuff.  We want to keep
@@ -382,12 +383,12 @@
             log.debug("Authenticator: 'change' not supported by script")
         return False
 
+authen_map = {'script' : CuminAuthenticatorScript}
 if have_ldap:
-    authen_map = {'ldap': CuminAuthenticatorLDAP,
-                  'ldaps': CuminAuthenticatorLDAP,
-                  'script': CuminAuthenticatorScript}
-else:
-    authen_map = {'script': CuminAuthenticatorScript}
+    authen_map['ldap'] = CuminAuthenticatorLDAP
+    authen_map['ldaps'] = CuminAuthenticatorLDAP
+if CuminAuthenticatorKerberos.isKerbAvail():
+    authen_map['kerb'] = CuminAuthenticatorKerberos
 
 class CuminAuthenticator(object):
     def __init__(self, app, log_authentication=True):

Modified: trunk/cumin/python/cumin/config.py
===================================================================
--- trunk/cumin/python/cumin/config.py	2012-09-27 19:35:54 UTC (rev 5485)
+++ trunk/cumin/python/cumin/config.py	2012-09-28 15:10:33 UTC (rev 5486)
@@ -141,6 +141,12 @@
 
         param = ConfigParameter(self, "ldap_timeout", int)
         param.default  = 30
+        
+        param = ConfigParameter(self, "kerberos_server", str)
+        param.default = ""
+        
+        param = ConfigParameter(self, "kerberos_realm", str)
+        param.default = ""
 
         self.log_file = ConfigParameter(self, "log-file", str)
 

Added: trunk/cumin/python/cumin/kerbauth.py
===================================================================
--- trunk/cumin/python/cumin/kerbauth.py	                        (rev 0)
+++ trunk/cumin/python/cumin/kerbauth.py	2012-09-28 15:10:33 UTC (rev 5486)
@@ -0,0 +1,37 @@
+import logging
+try:
+    import kerberos
+    have_kerberos = True
+except:
+    have_kerberos = False
+    
+log = logging.getLogger("cumin.kerbauth")
+    
+
+class CuminAuthenticatorKerberos(object):
+    def __init__(self, mech, app):
+        log.info("Initializing %s", self)
+        self.kerb_url = app.kerberos_server
+        self.kerb_realm = app.kerberos_realm
+        if (self.kerb_url is not None and self.kerb_realm is not None 
+            and self.kerb_url is not "" and self.kerb_realm is not ""):
+            self.valid = True
+        else:
+            self.valid = False
+            log.info("Required values for kerberos_server and kerberos_realm not set")
+        
+    def authenticate(self, username, password):
+        log.debug("Authenticating for user %s against %s", (username, self.__class__.__name__))
+        isAuth = False
+        if self.valid:
+            try:
+                isAuth = kerberos.checkPassword(username, password, self.kerb_url, self.kerb_realm)
+            except Exception, e:
+                log.debug("Auth failed %s" % e)
+        else:
+            log.error("Kerberos authentication failed due to an invalid kerberos server/realm config")
+        return isAuth         
+
+    @staticmethod
+    def isKerbAvail():
+        return have_kerberos
\ No newline at end of file


Property changes on: trunk/cumin/python/cumin/kerbauth.py
___________________________________________________________________
Added: svn:mime-type
   + text/plain



More information about the cumin-developers mailing list