1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
|
/**
* Copyright 2016 Patrick Uiterwijk
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <Python.h>
#include <krb5.h>
krb5_context kcontext;
static PyObject *has_creds(PyObject *self, PyObject *args);
static PyObject *
get_username(PyObject *self, PyObject *args)
{
const char *realm;
if (!PyArg_ParseTuple(args, "s", &realm))
return NULL;
krb5_error_code code;
krb5_ccache cache;
krb5_cccol_cursor cursor;
char *defname;
krb5_principal princ;
if(krb5_cccol_cursor_new(kcontext, &cursor)) {
PyErr_SetString(PyExc_RuntimeError, "Error getting CCache Collection");
return NULL;
}
while (!(code = krb5_cccol_cursor_next(kcontext, cursor, &cache)) &&
cache != NULL) {
if(krb5_cc_get_principal(kcontext, cache, &princ)) {
// No valid principal
krb5_cc_close(kcontext, cache);
continue;
}
if(strcmp(princ->realm.data, realm)) {
// Not the correct realm
krb5_cc_close(kcontext, cache);
continue;
}
if(krb5_unparse_name_flags(kcontext, princ, KRB5_PRINCIPAL_UNPARSE_NO_REALM, &defname)) {
krb5_cc_close(kcontext, cache);
continue;
}
krb5_cc_close(kcontext, cache);
return Py_BuildValue("s", defname);
}
Py_RETURN_NONE;
}
static PyObject *
has_creds(PyObject *self, PyObject *args)
{
krb5_ccache cache;
krb5_cccol_cursor cursor;
krb5_cc_cursor cache_cursor;
krb5_creds creds;
krb5_error_code code;
int found = FALSE;
if (krb5_cccol_cursor_new(kcontext, &cursor))
Py_RETURN_FALSE;
while (!(code = krb5_cccol_cursor_next(kcontext, cursor, &cache)) &&
cache != NULL)
{
code = krb5_cc_start_seq_get(kcontext, cache, &cache_cursor);
if (code)
break;
while (0 == krb5_cc_next_cred(kcontext, cache, &cache_cursor, &creds))
{
if (!krb5_is_config_principal(kcontext, creds.server))
{
found = TRUE;
krb5_free_cred_contents(kcontext, &creds);
break;
}
}
krb5_cc_end_seq_get(kcontext, cache, &cache_cursor);
krb5_cc_close(kcontext, cache);
if (found)
/* If a credential is already found in this current
* credential cache, no need to iterate next credential
* cache and terminate now. */
break;
}
krb5_cccol_cursor_free(kcontext, &cursor);
if (found)
Py_RETURN_TRUE;
else
Py_RETURN_FALSE;
}
static PyMethodDef CCColUtilsMethods[] = {
{"get_user_for_realm", get_username, METH_VARARGS, "Get username for a realm"},
{"has_creds", has_creds, METH_NOARGS, "Check if there is any credentials."},
{NULL, NULL, 0, NULL}
};
#if PY_MAJOR_VERSION == 2
PyMODINIT_FUNC
initcccolutils(void)
{
if(krb5_init_context(&kcontext)) {
PyErr_SetString(PyExc_RuntimeError, "Error initializing krb5");
}
(void) Py_InitModule("cccolutils", CCColUtilsMethods);
}
#elif PY_MAJOR_VERSION == 3
static struct PyModuleDef cccolutilsmodule = {
PyModuleDef_HEAD_INIT,
"cccolutils",
NULL,
-1,
CCColUtilsMethods
};
PyMODINIT_FUNC
PyInit_cccolutils(void)
{
if(krb5_init_context(&kcontext)) {
PyErr_SetString(PyExc_RuntimeError, "Error initializing krb5");
return NULL;
}
return PyModule_Create(&cccolutilsmodule);
}
#else
#error "Only Py2 and Py3 supported"
#endif
|
