r5486 - in trunk/cumin: bin etc python/cumin
croberts at fedoraproject.org
croberts at fedoraproject.org
Fri Sep 28 15:10:35 UTC 2012
Author: croberts
Date: 2012-09-28 15:10:33 +0000 (Fri, 28 Sep 2012)
New Revision: 5486
Added:
trunk/cumin/python/cumin/kerbauth.py
Modified:
trunk/cumin/bin/cumin-web
trunk/cumin/etc/cumin.conf
trunk/cumin/python/cumin/authenticator.py
trunk/cumin/python/cumin/config.py
Log:
BZ 799129: Enabling kerberos authentication. Using python-kerberos library to perform authentication against configured kerberos_server and kerberos_realm.
Modified: trunk/cumin/bin/cumin-web
===================================================================
--- trunk/cumin/bin/cumin-web 2012-09-27 19:35:54 UTC (rev 5485)
+++ trunk/cumin/bin/cumin-web 2012-09-28 15:10:33 UTC (rev 5486)
@@ -70,6 +70,10 @@
cumin.ldap_tls_cacertdir = values.ldap_tls_cacertdir
cumin.ldap_tls_cacertfile = values.ldap_tls_cacertfile
+def set_kerberos_configs(cumin, values):
+ cumin.kerberos_server = values.kerberos_server
+ cumin.kerberos_realm = values.kerberos_realm
+
def check_cert_files(opts):
# If a certificate or key file has been specified,
# check to make sure that both exist and that the
@@ -214,6 +218,7 @@
set_aviary_configs(cumin, values)
set_wallaby_configs(cumin, values, broker_uris)
set_ldap_configs(cumin, values)
+ set_kerberos_configs(cumin, values)
# Not used right now
#cumin.auth_create_ondemand = values.auth_create_ondemand
Modified: trunk/cumin/etc/cumin.conf
===================================================================
--- trunk/cumin/etc/cumin.conf 2012-09-27 19:35:54 UTC (rev 5485)
+++ trunk/cumin/etc/cumin.conf 2012-09-28 15:10:33 UTC (rev 5486)
@@ -120,6 +120,8 @@
# ldap_tls_cacertfile:
# ldap_tls_cacertdir:
# ldap_timeout: 30
+# kerberos_server:
+# kerberos_realm:
#notification-timeout: 180
# Number of seconds that a message in the yellow notification banner
@@ -352,6 +354,17 @@
## ldap_timeout: 30
## Timeout in seconds for connections to an LDAP server
+## kerberos_server:
+## setting this [in addition to auth:kerb and kerberos_realm] will activate
+## kerberos authentication for cumin. The kerberos_server string should
+## be either the IP address or FQDN of the kerberos_server.
+
+## kerberos_realm:
+## setting this [in addition to auth:kerb and kerberos_server] will activate
+## kerberos authentication for cumin. This should be set to the realm
+## defined by your kerberos server. Typically, this value will be in all caps
+## and look like "EXAMPLE.COM"
+
## [data]
## log-file:
Modified: trunk/cumin/python/cumin/authenticator.py
===================================================================
--- trunk/cumin/python/cumin/authenticator.py 2012-09-27 19:35:54 UTC (rev 5485)
+++ trunk/cumin/python/cumin/authenticator.py 2012-09-28 15:10:33 UTC (rev 5486)
@@ -10,6 +10,7 @@
from subprocess import PIPE
from psycopg2 import IntegrityError
import syslog
+from kerbauth import CuminAuthenticatorKerberos
# Send sensitive authentication logs to syslog
# but use this for other stuff. We want to keep
@@ -382,12 +383,12 @@
log.debug("Authenticator: 'change' not supported by script")
return False
+authen_map = {'script' : CuminAuthenticatorScript}
if have_ldap:
- authen_map = {'ldap': CuminAuthenticatorLDAP,
- 'ldaps': CuminAuthenticatorLDAP,
- 'script': CuminAuthenticatorScript}
-else:
- authen_map = {'script': CuminAuthenticatorScript}
+ authen_map['ldap'] = CuminAuthenticatorLDAP
+ authen_map['ldaps'] = CuminAuthenticatorLDAP
+if CuminAuthenticatorKerberos.isKerbAvail():
+ authen_map['kerb'] = CuminAuthenticatorKerberos
class CuminAuthenticator(object):
def __init__(self, app, log_authentication=True):
Modified: trunk/cumin/python/cumin/config.py
===================================================================
--- trunk/cumin/python/cumin/config.py 2012-09-27 19:35:54 UTC (rev 5485)
+++ trunk/cumin/python/cumin/config.py 2012-09-28 15:10:33 UTC (rev 5486)
@@ -141,6 +141,12 @@
param = ConfigParameter(self, "ldap_timeout", int)
param.default = 30
+
+ param = ConfigParameter(self, "kerberos_server", str)
+ param.default = ""
+
+ param = ConfigParameter(self, "kerberos_realm", str)
+ param.default = ""
self.log_file = ConfigParameter(self, "log-file", str)
Added: trunk/cumin/python/cumin/kerbauth.py
===================================================================
--- trunk/cumin/python/cumin/kerbauth.py (rev 0)
+++ trunk/cumin/python/cumin/kerbauth.py 2012-09-28 15:10:33 UTC (rev 5486)
@@ -0,0 +1,37 @@
+import logging
+try:
+ import kerberos
+ have_kerberos = True
+except:
+ have_kerberos = False
+
+log = logging.getLogger("cumin.kerbauth")
+
+
+class CuminAuthenticatorKerberos(object):
+ def __init__(self, mech, app):
+ log.info("Initializing %s", self)
+ self.kerb_url = app.kerberos_server
+ self.kerb_realm = app.kerberos_realm
+ if (self.kerb_url is not None and self.kerb_realm is not None
+ and self.kerb_url is not "" and self.kerb_realm is not ""):
+ self.valid = True
+ else:
+ self.valid = False
+ log.info("Required values for kerberos_server and kerberos_realm not set")
+
+ def authenticate(self, username, password):
+ log.debug("Authenticating for user %s against %s", (username, self.__class__.__name__))
+ isAuth = False
+ if self.valid:
+ try:
+ isAuth = kerberos.checkPassword(username, password, self.kerb_url, self.kerb_realm)
+ except Exception, e:
+ log.debug("Auth failed %s" % e)
+ else:
+ log.error("Kerberos authentication failed due to an invalid kerberos server/realm config")
+ return isAuth
+
+ @staticmethod
+ def isKerbAvail():
+ return have_kerberos
\ No newline at end of file
Property changes on: trunk/cumin/python/cumin/kerbauth.py
___________________________________________________________________
Added: svn:mime-type
+ text/plain
More information about the cumin-developers
mailing list