mart-w/kanidm
1
0
Fork 0
mirror of https://github.com/kanidm/kanidm.git synced 2025-02-23 04:27:02 +01:00
Code Issues Actions 16 Packages Projects Releases Wiki Activity

Pykanidm fixes (#3030)

Browse source
This commit is contained in:
James Hodgkinson 2024-09-10 10:36:50 +10:00 committed by GitHub
parent 938ad90f3b
commit 6664ce8f02
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
17 changed files with 1113 additions and 1231 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Makefile
View file

@ -189,7 +189,7 @@ test/pykanidm/pytest: ## python library testing
test/pykanidm/lint: ## python library linting
cd pykanidm && \
poetry install && \
poetry run ruff tests kanidm
poetry run ruff check tests kanidm
.PHONY: test/pykanidm/mypy
test/pykanidm/mypy: ## python library type checking

219
pykanidm/kanidm/__init__.py
View file

@ -1,9 +1,10 @@
""" Kanidm python module """
"""Kanidm python module"""
from datetime import datetime
from functools import lru_cache
import json as json_lib # because we're taking a field "json" at various points
from logging import Logger, getLogger
import logging
import os
from pathlib import Path
import platform
@ -54,9 +55,7 @@ class Endpoints:
XDG_CACHE_HOME = (
Path(os.getenv("LOCALAPPDATA", "~/AppData/Local")) / "cache"
if platform.system() == "Windows"
else Path(os.getenv("XDG_CACHE_HOME", "~/.cache"))
Path(os.getenv("LOCALAPPDATA", "~/AppData/Local")) / "cache" if platform.system() == "Windows" else Path(os.getenv("XDG_CACHE_HOME", "~/.cache"))
)
TOKEN_PATH = XDG_CACHE_HOME / "kanidm_tokens"
@ -80,6 +79,7 @@ class KanidmClient:
# pylint: disable=too-many-instance-attributes,too-many-arguments
def __init__(
self,
instance_name: Optional[str] = None,
config: Optional[KanidmClientConfig] = None,
config_file: Optional[Union[Path, str]] = None,
uri: Optional[str] = None,
@ -93,9 +93,9 @@ class KanidmClient:
"""Constructor for KanidmClient"""
self.logger = logger or getLogger(__name__)
self.instance_name = instance_name # TODO: use this in loaders etc
if config is not None:
self.config = config
else:
self.config = KanidmClientConfig.model_validate(
{
@ -118,28 +118,31 @@ class KanidmClient:
if self.config.uri is None:
raise ValueError("Please initialize this with a server URI")
self._ssl: Optional[Union[bool, ssl.SSLContext]] = None
self._ssl_context: Optional[Union[bool, ssl.SSLContext]] = None
self._configure_ssl()
def _configure_ssl(self) -> None:
"""Sets up SSL configuration for the client"""
if self.config.verify_certificate is False:
self._ssl = False
if False in [self.config.verify_certificate, self.config.verify_hostnames ]:
logging.debug("Setting up SSL context with no verification")
self._ssl_context = ssl.create_default_context(purpose=ssl.Purpose.SERVER_AUTH)
self._ssl_context.hostname_checks_common_name = False
self._ssl_context.check_hostname = False
self._ssl_context.verify_mode = ssl.CERT_NONE
else:
if (
self.config.ca_path is not None
and not Path(self.config.ca_path).expanduser().resolve().exists()
):
if self.config.ca_path is not None:
if not Path(self.config.ca_path).expanduser().resolve().exists():
raise FileNotFoundError(f"CA Path not found: {self.config.ca_path}")
self.logger.debug(
"Setting up SSL context with CA path: %s", self.config.ca_path
)
self._ssl = ssl.create_default_context(cafile=self.config.ca_path)
if self._ssl is not False:
# ignoring this for typing because mypy is being weird
# ssl.SSLContext.check_hostname is totally a thing
# https://docs.python.org/3/library/ssl.html#ssl.SSLContext.check_hostname
self._ssl.check_hostname = self.config.verify_hostnames # type: ignore
else:
self.logger.debug("Setting up SSL context with CA path=%s", self.config.ca_path)
self._ssl_context = ssl.create_default_context(purpose=ssl.Purpose.SERVER_AUTH,cafile=self.config.ca_path)
else:
logging.debug("Setting up default SSL context")
self._ssl_context = ssl.create_default_context(purpose=ssl.Purpose.SERVER_AUTH)
logging.debug("SSL context verify_hostnames=%s", self.config.verify_hostnames)
self._ssl_context.check_hostname = self.config.verify_hostnames
def parse_config_data(
self,
@ -211,14 +214,15 @@ class KanidmClient:
response_headers: Dict[str, Any] = {}
response_status: int = -1
async with aiohttp.client.ClientSession() as session:
ssl_context = self._ssl_context if self._ssl_context is not None else False
async with session.request(
method=method,
url=self.get_path_uri(path),
headers=headers,
timeout=timeout,
timeout=aiohttp.client.ClientTimeout(timeout),
json=json,
params=params,
ssl=self._ssl,
ssl=ssl_context,
) as request:
content = await request.content.read()
if len(content) > 0:
@ -227,9 +231,7 @@ class KanidmClient:
response_headers = dict(request.headers)
response_status = request.status
except json_lib.JSONDecodeError as json_error:
self.logger.error(
"Failed to JSON Decode Response: %s", json_error
)
self.logger.error("Failed to JSON Decode Response: %s", json_error)
self.logger.error("Response data: %s", content)
response_json = None
else:
@ -241,9 +243,7 @@ class KanidmClient:
"status_code": response_status,
}
self.logger.debug(json_lib.dumps(response_input, default=str, indent=4))
response: ClientResponse[Any] = ClientResponse.model_validate(
response_input
)
response: ClientResponse[Any] = ClientResponse.model_validate(response_input)
return response
async def call_delete(
@ -254,9 +254,7 @@ class KanidmClient:
timeout: Optional[int] = None,
) -> ClientResponse[Any]:
"""does a DELETE call to the server"""
return await self._call(
method="DELETE", path=path, headers=headers, json=json, timeout=timeout
)
return await self._call(method="DELETE", path=path, headers=headers, json=json, timeout=timeout)
async def call_get(
self,
@ -277,9 +275,7 @@ class KanidmClient:
) -> ClientResponse[Any]:
"""does a POST call to the server"""
return await self._call(
method="POST", path=path, headers=headers, json=json, timeout=timeout
)
return await self._call(method="POST", path=path, headers=headers, json=json, timeout=timeout)
async def call_patch(
self,
@ -290,9 +286,7 @@ class KanidmClient:
) -> ClientResponse[Any]:
"""does a PATCH call to the server"""
return await self._call(
method="PATCH", path=path, headers=headers, json=json, timeout=timeout
)
return await self._call(method="PATCH", path=path, headers=headers, json=json, timeout=timeout)
async def call_put(
self,
@ -303,13 +297,9 @@ class KanidmClient:
) -> ClientResponse[Any]:
"""does a PUT call to the server"""
return await self._call(
method="PUT", path=path, headers=headers, json=json, timeout=timeout
)
return await self._call(method="PUT", path=path, headers=headers, json=json, timeout=timeout)
async def auth_init(
self, username: str, update_internal_auth_token: bool = False
) -> AuthInitResponse:
async def auth_init(self, username: str, update_internal_auth_token: bool = False) -> AuthInitResponse:
"""init step, starts the auth session, sets the class-local session ID"""
init_auth = {"step": {"init": username}}
@ -330,9 +320,7 @@ class KanidmClient:
if K_AUTH_SESSION_ID not in response.headers:
self.logger.debug("response.content: %s", response.content)
self.logger.debug("response.headers: %s", response.headers)
raise ValueError(
f"Missing {K_AUTH_SESSION_ID} header in init auth response: {response.headers}"
)
raise ValueError(f"Missing {K_AUTH_SESSION_ID} header in init auth response: {response.headers}")
else:
self.config.auth_token = response.headers[K_AUTH_SESSION_ID]
@ -398,17 +386,13 @@ class KanidmClient:
if username is None and password is None:
if self.config.username is None or self.config.password is None:
# pylint: disable=line-too-long
raise ValueError(
"Need username/password to be in caller or class settings before calling authenticate_password"
)
raise ValueError("Need username/password to be in caller or class settings before calling authenticate_password")
username = self.config.username
password = self.config.password
if username is None or password is None:
raise ValueError("Username and Password need to be set somewhere!")
auth_init: AuthInitResponse = await self.auth_init(
username, update_internal_auth_token=update_internal_auth_token
)
auth_init: AuthInitResponse = await self.auth_init(username, update_internal_auth_token=update_internal_auth_token)
if auth_init.response is None:
raise NotImplementedError("This should throw a really cool response")
@ -440,9 +424,7 @@ class KanidmClient:
if password is None:
password = self.config.password
if password is None:
raise ValueError(
"Password has to be passed to auth_step_password or in self.password!"
)
raise ValueError("Password has to be passed to auth_step_password or in self.password!")
if sessionid is not None:
headers = {K_AUTH_SESSION_ID: sessionid}
@ -450,9 +432,7 @@ class KanidmClient:
headers = {K_AUTH_SESSION_ID: self.config.auth_token}
cred_auth = {"step": {"cred": {"password": password}}}
response = await self.call_post(
path=Endpoints.AUTH, json=cred_auth, headers=headers
)
response = await self.call_post(path=Endpoints.AUTH, json=cred_auth, headers=headers)
if response.status_code != 200:
# TODO: write test coverage auth_step_password raises AuthCredFailed
@ -524,9 +504,7 @@ class KanidmClient:
path = f"/v1/account/{username}/_radius/_token"
response = await self.call_get(path)
if response.status_code == 404:
raise NoMatchingEntries(
f"No user found: '{username}' {response.headers['x-kanidm-opid']}"
)
raise NoMatchingEntries(f"No user found: '{username}' {response.headers['x-kanidm-opid']}")
return response
async def oauth2_rs_list(self) -> List[OAuth2Rs]:
@ -535,9 +513,7 @@ class KanidmClient:
if response.data is None:
return []
if response.status_code != 200:
raise ValueError(
f"Failed to get oauth2 resource servers: {response.content}"
)
raise ValueError(f"Failed to get oauth2 resource servers: {response.content}")
oauth2_rs_list = Oauth2RsList.model_validate(response.data)
return [oauth2_rs.as_oauth2_rs for oauth2_rs in oauth2_rs_list.root]
@ -546,13 +522,9 @@ class KanidmClient:
endpoint = f"{Endpoints.OAUTH2}/{rs_name}"
response: ClientResponse[IOauth2Rs] = await self.call_get(endpoint)
if response.status_code != 200:
raise ValueError(
f"Failed to get oauth2 resource server: {response.content}"
)
raise ValueError(f"Failed to get oauth2 resource server: {response.content}")
if response.data is None:
raise ValueError(
f"Failed to get oauth2 resource server: {response.content}"
)
raise ValueError(f"Failed to get oauth2 resource server: {response.content}")
return RawOAuth2Rs(**response.data).as_oauth2_rs
async def oauth2_rs_secret_get(self, rs_name: str) -> str:
@ -560,9 +532,7 @@ class KanidmClient:
endpoint = f"{Endpoints.OAUTH2}/{rs_name}/_basic_secret"
response: ClientResponse[str] = await self.call_get(endpoint)
if response.status_code != 200:
raise ValueError(
f"Failed to get oauth2 resource server secret: {response.content}"
)
raise ValueError(f"Failed to get oauth2 resource server secret: {response.content}")
return response.data or ""
async def oauth2_rs_delete(self, rs_name: str) -> ClientResponse[None]:
@ -571,9 +541,7 @@ class KanidmClient:
return await self.call_delete(endpoint)
async def oauth2_rs_basic_create(
self, rs_name: str, displayname: str, origin: str
) -> ClientResponse[None]:
async def oauth2_rs_basic_create(self, rs_name: str, displayname: str, origin: str) -> ClientResponse[None]:
"""Create a basic OAuth2 RS"""
self._validate_is_valid_origin_url(origin)
@ -593,9 +561,7 @@ class KanidmClient:
"""Check if it's HTTPS and a valid URL as far as we can tell"""
parsed_url = yarl.URL(url)
if parsed_url.scheme not in ["http", "https"]:
raise ValueError(
f"Invalid scheme: {parsed_url.scheme} for origin URL: {url}"
)
raise ValueError(f"Invalid scheme: {parsed_url.scheme} for origin URL: {url}")
if parsed_url.host is None:
raise ValueError(f"Empty/invalid host for origin URL: {url}")
if parsed_url.user is not None:
@ -610,13 +576,8 @@ class KanidmClient:
return []
if response.status_code != 200:
raise ValueError(f"Failed to get service accounts: {response.content}")
service_account_list = ServiceAccountList.model_validate(
json_lib.loads(response.content)
)
return [
service_account.as_service_account
for service_account in service_account_list.root
]
service_account_list = ServiceAccountList.model_validate(json_lib.loads(response.content))
return [service_account.as_service_account for service_account in service_account_list.root]
async def service_account_get(self, name: str) -> ServiceAccount:
"""Get a service account"""
@ -628,9 +589,7 @@ class KanidmClient:
raise ValueError(f"Failed to get service account: {response.content}")
return RawServiceAccount(**response.data).as_service_account
async def service_account_create(
self, name: str, displayname: str
) -> ClientResponse[None]:
async def service_account_create(self, name: str, displayname: str) -> ClientResponse[None]:
"""Create a service account"""
endpoint = f"{Endpoints.SERVICE_ACCOUNT}"
payload = {
@ -661,25 +620,17 @@ class KanidmClient:
json=payload,
)
async def service_account_delete_ssh_pubkey(
self, id: str, tag: str
) -> ClientResponse[None]:
return await self.call_delete(
f"{Endpoints.SERVICE_ACCOUNT}/{id}/_ssh_pubkeys/{tag}"
)
async def service_account_delete_ssh_pubkey(self, id: str, tag: str) -> ClientResponse[None]:
return await self.call_delete(f"{Endpoints.SERVICE_ACCOUNT}/{id}/_ssh_pubkeys/{tag}")
async def service_account_generate_api_token(
self, account_id: str, label: str, expiry: str, read_write: bool = False
) -> ClientResponse[None]:
async def service_account_generate_api_token(self, account_id: str, label: str, expiry: str, read_write: bool = False) -> ClientResponse[None]:
"""Create a service account API token, expiry needs to be in RFC3339 format."""
# parse the expiry as rfc3339
try:
datetime.strptime(expiry, "%Y-%m-%dT%H:%M:%SZ")
except Exception as error:
raise ValueError(
f"Failed to parse expiry from {expiry} (needs to be RFC3339 format): {error}"
)
raise ValueError(f"Failed to parse expiry from {expiry} (needs to be RFC3339 format): {error}")
payload = {
"label": label,
"expiry": expiry,
@ -739,23 +690,17 @@ class KanidmClient:
return await self.call_delete(endpoint)
async def group_set_members(
self, id: str, members: List[str]
) -> ClientResponse[None]:
async def group_set_members(self, id: str, members: List[str]) -> ClientResponse[None]:
"""Set group member list"""
endpoint = f"{Endpoints.GROUP}/{id}/_attr/member"
return await self.call_put(endpoint, json=members)
async def group_add_members(
self, id: str, members: List[str]
) -> ClientResponse[None]:
async def group_add_members(self, id: str, members: List[str]) -> ClientResponse[None]:
"""Add members to a group"""
endpoint = f"{Endpoints.GROUP}/{id}/_attr/member"
return await self.call_post(endpoint, json=members)
async def group_delete_members(
self, id: str, members: List[str]
) -> ClientResponse[None]:
async def group_delete_members(self, id: str, members: List[str]) -> ClientResponse[None]:
"""Remove members from a group"""
endpoint = f"{Endpoints.GROUP}/{id}/_attr/member"
return await self.call_delete(endpoint, json=members)
@ -780,9 +725,7 @@ class KanidmClient:
raise ValueError(f"Failed to get person: {response.content}")
return RawPerson(**response.data).as_person
async def person_account_create(
self, name: str, displayname: str
) -> ClientResponse[None]:
async def person_account_create(self, name: str, displayname: str) -> ClientResponse[None]:
"""Create a person account"""
payload = {
"attrs": {
@ -822,9 +765,7 @@ class KanidmClient:
endpoint = f"{Endpoints.PERSON}/{id}"
return await self.call_delete(endpoint)
async def person_account_post_ssh_key(
self, id: str, tag: str, pubkey: str
) -> ClientResponse[None]:
async def person_account_post_ssh_key(self, id: str, tag: str, pubkey: str) -> ClientResponse[None]:
"""Create an SSH key for a user"""
endpoint = f"{Endpoints.PERSON}/{id}/_ssh_pubkeys"
@ -832,9 +773,7 @@ class KanidmClient:
return await self.call_post(endpoint, json=payload)
async def person_account_delete_ssh_key(
self, id: str, tag: str
) -> ClientResponse[None]:
async def person_account_delete_ssh_key(self, id: str, tag: str) -> ClientResponse[None]:
"""Delete an SSH key for a user"""
endpoint = f"{Endpoints.PERSON}/{id}/_ssh_pubkeys/{tag}"
@ -856,17 +795,13 @@ class KanidmClient:
payload = [expiry]
return await self.call_put(endpoint, json=payload)
async def group_account_policy_password_minimum_length_set(
self, id: str, minimum_length: int
) -> ClientResponse[None]:
async def group_account_policy_password_minimum_length_set(self, id: str, minimum_length: int) -> ClientResponse[None]:
"""set the account policy password minimum length for a group"""
endpoint = f"{Endpoints.GROUP}/{id}/_attr/auth_password_minimum_length"
payload = [minimum_length]
return await self.call_put(endpoint, json=payload)
async def group_account_policy_privilege_expiry_set(
self, id: str, expiry: int
) -> ClientResponse[None]:
async def group_account_policy_privilege_expiry_set(self, id: str, expiry: int) -> ClientResponse[None]:
"""set the account policy privilege expiry for a group"""
endpoint = f"{Endpoints.GROUP}/{id}/_attr/privilege_expiry"
payload = [expiry]
@ -880,40 +815,28 @@ class KanidmClient:
return []
return badlist
async def system_password_badlist_append(
self, new_passwords: List[str]
) -> ClientResponse[None]:
async def system_password_badlist_append(self, new_passwords: List[str]) -> ClientResponse[None]:
"""Add new items to the password badlist"""
return await self.call_post(
"/v1/system/_attr/badlist_password", json=new_passwords
)
return await self.call_post("/v1/system/_attr/badlist_password", json=new_passwords)
async def system_password_badlist_remove(
self, items: List[str]
) -> ClientResponse[None]:
async def system_password_badlist_remove(self, items: List[str]) -> ClientResponse[None]:
"""Remove items from the password badlist"""
return await self.call_delete("/v1/system/_attr/badlist_password", json=items)
async def system_denied_names_get(self) -> List[str]:
"""Get the denied names list"""
response: Optional[List[str]] = (
await self.call_get("/v1/system/_attr/denied_name")
).data
response: Optional[List[str]] = (await self.call_get("/v1/system/_attr/denied_name")).data
if response is None:
return []
return response
async def system_denied_names_append(
self, names: List[str]
) -> ClientResponse[None]:
async def system_denied_names_append(self, names: List[str]) -> ClientResponse[None]:
"""Add items to the denied names list"""
return await self.call_post("/v1/system/_attr/denied_name", json=names)
async def system_denied_names_remove(
self, names: List[str]
) -> ClientResponse[None]:
async def system_denied_names_remove(self, names: List[str]) -> ClientResponse[None]:
"""Remove items from the denied names list"""
return await self.call_delete("/v1/system/_attr/denied_name", json=names)
@ -978,9 +901,7 @@ class KanidmClient:
return await self.call_patch(endpoint, json=payload)
async def oauth2_rs_update_scope_map(
self, id: str, group: str, scopes: List[str]
) -> ClientResponse[None]:
async def oauth2_rs_update_scope_map(self, id: str, group: str, scopes: List[str]) -> ClientResponse[None]:
"""Update an OAuth2 scope map"""
endpoint = f"{Endpoints.OAUTH2}/{id}/_scopemap/{group}"
@ -995,9 +916,7 @@ class KanidmClient:
"""Delete an OAuth2 scope map"""
return await self.call_delete(f"{Endpoints.OAUTH2}/{id}/_scopemap/{group}")
async def oauth2_rs_update_sup_scope_map(
self, id: str, group: str, scopes: List[str]
) -> ClientResponse[None]:
async def oauth2_rs_update_sup_scope_map(self, id: str, group: str, scopes: List[str]) -> ClientResponse[None]:
"""Update an OAuth2 supplemental scope map"""
endpoint = f"{Endpoints.OAUTH2}/{id}/_sup_scopemap/{group}"

97
pykanidm/kanidm/tokens.py
View file

@ -1,4 +1,4 @@
""" User Auth Token related widgets """
"""User Auth Token related widgets"""
# pylint: disable=too-few-public-methods
import base64
@ -10,7 +10,7 @@ from pathlib import Path
from typing import Any, Dict, List, Optional, Tuple
from authlib.jose import JsonWebSignature # type: ignore
from pydantic import ConfigDict, BaseModel, RootModel
from pydantic import ConfigDict, BaseModel, Field
from . import TOKEN_PATH
@ -56,9 +56,7 @@ class JWSPayload(BaseModel):
def expiry_datetime(self) -> datetime:
"""parse the expiry and return a datetime object"""
year, day, seconds, _ = self.expiry
retval = datetime(
year=year, month=1, day=1, second=0, hour=0, tzinfo=timezone.utc
)
retval = datetime(year=year, month=1, day=1, second=0, hour=0, tzinfo=timezone.utc)
# day - 1 because we're already starting at day 1
retval += timedelta(days=day - 1, seconds=seconds)
return retval
@ -105,78 +103,73 @@ class JWS:
return header, payload, signature
class TokenStore(RootModel[Dict[str, str]]):
class ConfigInstance(BaseModel):
"""Configuration Instance"""
keys: Dict[str, Dict[str, Any]] = Field(dict())
tokens: Dict[str, str] = Field(dict())
class TokenStore(BaseModel):
"""Represents the user auth tokens, so we can load them from the user store"""
root: Dict[str, str]
# TODO: one day work out how to type the __iter__ on TokenStore properly. It's some kind of iter() that makes mypy unhappy.
def __iter__(self) -> Any:
"""overloading the default function"""
for key in self.root.keys():
yield key
def __getitem__(self, item: str) -> str:
"""overloading the default function"""
return self.root[item]
def __delitem__(self, item: str) -> None:
"""overloading the default function"""
del self.root[item]
def __setitem__(self, key: str, value: str) -> None:
"""overloading the default function"""
self.root[key] = value
instances: Dict[str, ConfigInstance] = Field({"" : {}})
def save(self, filepath: Path = TOKEN_PATH) -> None:
"""saves the cached tokens to disk"""
data = json.dumps(self.root, indent=2)
with filepath.expanduser().resolve().open(
mode="w", encoding="utf-8"
) as file_handle:
data = self.model_dump_json(indent=2)
with filepath.expanduser().resolve().open(mode="w", encoding="utf-8") as file_handle:
file_handle.write(data)
def load(
self, overwrite: bool = True, filepath: Path = TOKEN_PATH
) -> Dict[str, str]:
def load(self, overwrite: bool = True, filepath: Path = TOKEN_PATH) -> None:
"""Loads the tokens from from the store and caches them in memory - by default
from the local user's store path, but you can point it at any file path.
Will return the current cached store.
If overwrite=False, then it will add them to the existing in-memory store"""
token_path = filepath.expanduser().resolve()
if not token_path.exists():
tokens: Dict[str, str] = {}
tokens = TokenStore.model_validate({})
else:
with token_path.open(encoding="utf-8") as file_handle:
tokens = json.load(file_handle)
tokens = TokenStore.model_validate_json(file_handle.read())
if overwrite:
self.root = tokens
self = TokenStore.model_validate(tokens)
else:
for user in tokens:
self.root[user] = tokens[user]
# naive update
for instance, value in tokens.instances.items():
if instance not in self.instances:
self.instances[instance] = value
# TODO: make this work properly
# self.validate_tokens()
self.validate_tokens()
logging.debug(json.dumps(tokens, indent=4))
return self.root
logging.debug(tokens.model_dump_json(indent=2))
def validate_tokens(self) -> None:
"""validates the JWS tokens for format, not their signature - PRs welcome"""
for username in self.root:
logging.debug("Parsing %s", username)
for instance_name, instance in self.instances.items():
for username, token in instance.tokens.items():
logging.debug("Parsing instance=%s username=%s", instance_name, username)
# TODO: Work out how to get the validation working. We probably shouldn't be worried about this since we're using it for auth...
logging.debug(
JsonWebSignature().deserialize_compact(s=self[username], key=None)
)
logging.debug(JsonWebSignature().deserialize_compact(s=token, key=None))
def token_info(self, username: str) -> Optional[JWSPayload]:
def token_info(self, username: str, instance: Optional[str] = None) -> Optional[JWSPayload]:
"""grabs a token and returns a complex object object"""
if username not in self:
instance = instance if instance is not None else ""
if instance not in self.instances:
logging.error("No instance found for %s", instance)
return None
parsed_object = JsonWebSignature().deserialize_compact(
s=self[username], key=None
)
if not hasattr(self.instances[instance], "tokens"):
logging.error("No tokens found for instance '%s'", instance)
return None
token = self.instances[instance].tokens.get(username)
if token is None:
logging.debug("No token found for %s", username)
return None
parsed_object = JsonWebSignature().deserialize_compact(s=token, key=None)
logging.debug(parsed_object)
return JWSPayload.model_validate_json(parsed_object.payload)

1868
pykanidm/poetry.lock generated
View file

File diff suppressed because it is too large Load diff

57
pykanidm/tests/test_authenticate.py
View file

@ -1,4 +1,4 @@
""" testing auth things """
"""testing auth things"""
import logging
import os
@ -71,13 +71,8 @@ async def test_auth_begin(client_configfile: KanidmClient) -> None:
@pytest.mark.asyncio
async def test_authenticate_flow(client_configfile: KanidmClient) -> None:
"""tests the authenticate() flow"""
if (
client_configfile.config.username is None
or client_configfile.config.password is None
):
pytest.skip(
"Can't run this without a username and password set in the config file"
)
if client_configfile.config.username is None or client_configfile.config.password is None:
pytest.skip("Can't run this without a username and password set in the config file")
client_configfile.config.auth_token = None
print(f"Doing client.authenticate for {client_configfile.config.username}")
@ -103,11 +98,7 @@ async def test_authenticate_flow_fail(client_configfile: KanidmClient) -> None:
if not bool(os.getenv("RUN_SCARY_TESTS", None)):
pytest.skip(reason="Skipping because env var RUN_SCARY_TESTS isn't set")
print("Starting client...")
if (
client_configfile.config.uri is None
or client_configfile.config.username is None
or client_configfile.config.password is None
):
if client_configfile.config.uri is None or client_configfile.config.username is None or client_configfile.config.password is None:
pytest.skip("Please ensure you have a username, password and uri in the config")
print(f"Doing client.authenticate for {client_configfile.config.username}")
@ -130,9 +121,7 @@ async def test_authenticate_flow_fail(client_configfile: KanidmClient) -> None:
@pytest.mark.asyncio
async def test_authenticate_inputs_validation(
client: KanidmClient, mocker: MockerFixture
) -> None:
async def test_authenticate_inputs_validation(client: KanidmClient, mocker: MockerFixture) -> None:
"""tests if you pass username but not password and password but not username"""
resp = MockResponse("crabs are cool", 200)
@ -172,31 +161,33 @@ async def test_auth_step_password(client: KanidmClient) -> None:
async def test_authenticate_with_token(client_configfile: KanidmClient) -> None:
"""tests auth with a token, needs to have a valid token in your local cache"""
logging.basicConfig(level=logging.DEBUG)
if "KANIDM_TEST_USERNAME" in os.environ:
test_username: str = os.environ["KANIDM_TEST_USERNAME"]
print(f"Using username {test_username} from KANIDM_TEST_USERNAME env var")
else:
test_username = "idm_admin"
print(
f"Using username {test_username} by default - set KANIDM_TEST_USERNAME env var if you want to change this."
)
print(f"Using username {test_username} by default - set KANIDM_TEST_USERNAME env var if you want to change this.")
tokens = TokenStore.model_validate({})
tokens.load()
if test_username not in tokens:
print(f"Can't find {test_username} user in token store")
raise pytest.skip(f"Can't find {test_username} user in token store")
test_token: str = tokens[test_username]
if not await client_configfile.check_token_valid(test_token):
print(f"Token for {test_username} isn't valid")
pytest.skip(f"Token for {test_username} isn't valid")
else:
print("Token was noted as valid, so auth works!")
# TODO: make this actually work now instances are a thing
# tests the "we set a token and well it works."
client_configfile.config.auth_token = tokens[test_username]
result = await client_configfile.call_get("/v1/self")
print(result)
# if test_username not in tokens:
# print(f"Can't find {test_username} user in token store")
# raise pytest.skip(f"Can't find {test_username} user in token store")
# test_token: str = tokens[test_username]
# if not await client_configfile.check_token_valid(test_token):
# print(f"Token for {test_username} isn't valid")
# pytest.skip(f"Token for {test_username} isn't valid")
# else:
# print("Token was noted as valid, so auth works!")
assert result.status_code == 200
# # tests the "we set a token and well it works."
# client_configfile.config.auth_token = tokens[test_username]
# result = await client_configfile.call_get("/v1/self")
# print(result)
# assert result.status_code == 200

2
pykanidm/tests/test_config_loader.py
View file

@ -1,4 +1,4 @@
""" tests the config file things """
"""tests the config file things"""
import logging
from pathlib import Path

22
pykanidm/tests/test_jwt.py
View file

@ -1,6 +1,7 @@
""" Testing JWS things things """
"""Testing JWS things things"""
from datetime import datetime, timezone
import logging
import pytest
@ -49,10 +50,21 @@ def test_jws_parser() -> None:
def test_tokenstuff() -> None:
"""tests stuff"""
token_store = TokenStore.model_validate({})
token_store[
"idm_admin"
] = "eyJhbGciOiJFUzI1NiIsImp3ayI6eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2IiwieCI6Im1KQTgtTURfeFRxQXBmSU9nbFptNXJ6RWhoQ3hDdjRxZFNpeGxjV1Q3ZmsiLCJ5IjoiNy0yVkNuY0h3NEF1WVJpYVpYT2FoVXRGMUE2SDd3eUxrUW1FekduS0pKcyIsImFsZyI6IkVTMjU2IiwidXNlIjoic2lnIn0sInR5cCI6IkpXVCJ9.eyJzZXNzaW9uX2lkIjoiMTBmZDJjYzMtM2UxZS00MjM1LTk4NjEtNWQyNjQ3NTAyMmVkIiwiYXV0aF90eXBlIjoiZ2VuZXJhdGVkcGFzc3dvcmQiLCJleHBpcnkiOlsyMDIyLDI2NSwzMzkyMywyOTQyNTQwMDBdLCJ1dWlkIjoiMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDE4IiwibmFtZSI6ImlkbV9hZG1pbiIsImRpc3BsYXluYW1lIjoiSURNIEFkbWluaXN0cmF0b3IiLCJzcG4iOiJpZG1fYWRtaW5AbG9jYWxob3N0IiwibWFpbF9wcmltYXJ5IjpudWxsLCJsaW1fdWlkeCI6ZmFsc2UsImxpbV9ybWF4IjoxMjgsImxpbV9wbWF4IjoyNTYsImxpbV9mbWF4IjozMn0.rq1y7YNS9iCBWMmAu-FSa4-o4jrSSnMO_18zafgvLRtZFlB7j-Q68CzxceNN9C_1EWnc9uf4fOyeaSNUwGyaIQ" # noqa: E501 pylint: disable=line-too-long
logging.basicConfig(level=logging.DEBUG, force=True)
data = {
"instances": {
"": {
"tokens": {
"idm_admin": "eyJhbGciOiJFUzI1NiIsImp3ayI6eyJrdHkiOiJFQyIsImNydiI6IlAtMjU2IiwieCI6Im1KQTgtTURfeFRxQXBmSU9nbFptNXJ6RWhoQ3hDdjRxZFNpeGxjV1Q3ZmsiLCJ5IjoiNy0yVkNuY0h3NEF1WVJpYVpYT2FoVXRGMUE2SDd3eUxrUW1FekduS0pKcyIsImFsZyI6IkVTMjU2IiwidXNlIjoic2lnIn0sInR5cCI6IkpXVCJ9.eyJzZXNzaW9uX2lkIjoiMTBmZDJjYzMtM2UxZS00MjM1LTk4NjEtNWQyNjQ3NTAyMmVkIiwiYXV0aF90eXBlIjoiZ2VuZXJhdGVkcGFzc3dvcmQiLCJleHBpcnkiOlsyMDIyLDI2NSwzMzkyMywyOTQyNTQwMDBdLCJ1dWlkIjoiMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDE4IiwibmFtZSI6ImlkbV9hZG1pbiIsImRpc3BsYXluYW1lIjoiSURNIEFkbWluaXN0cmF0b3IiLCJzcG4iOiJpZG1fYWRtaW5AbG9jYWxob3N0IiwibWFpbF9wcmltYXJ5IjpudWxsLCJsaW1fdWlkeCI6ZmFsc2UsImxpbV9ybWF4IjoxMjgsImxpbV9wbWF4IjoyNTYsImxpbV9mbWF4IjozMn0.rq1y7YNS9iCBWMmAu-FSa4-o4jrSSnMO_18zafgvLRtZFlB7j-Q68CzxceNN9C_1EWnc9uf4fOyeaSNUwGyaIQ" # noqa: E501 pylint: disable=line-too-long
}
}
}
}
token_store = TokenStore.model_validate(data)
print(token_store.model_dump_json(indent=2))
info = token_store.token_info("idm_admin")
print(f"Parsed token: {info}")

2
pykanidm/tests/test_mocked.py
View file

@ -1,4 +1,4 @@
""" mocked tests """
"""mocked tests"""
# import asyncio
# import aiohttp

19
pykanidm/tests/test_oauth2.py
View file

@ -11,10 +11,13 @@ import pytest
@pytest.fixture(scope="function")
async def client() -> KanidmClient:
"""sets up a client with a basic thing"""
return KanidmClient(
try:
client = KanidmClient(
config_file=Path(__file__).parent.parent.parent / "examples/config_localhost",
)
except FileNotFoundError as error:
raise pytest.skip(f"File not found: {error}")
return client
@pytest.mark.network
@ -31,17 +34,11 @@ async def test_oauth2_rs_list(client: KanidmClient) -> None:
print("No KANIDM_PASSWORD env var set for testing")
raise pytest.skip("No KANIDM_PASSWORD env var set for testing")
auth_resp = await client.authenticate_password(
username, password, update_internal_auth_token=True
)
auth_resp = await client.authenticate_password(username, password, update_internal_auth_token=True)
if auth_resp.state is None:
raise ValueError(
"Failed to authenticate, check the admin password is set right"
)
raise ValueError("Failed to authenticate, check the admin password is set right")
if auth_resp.state.success is None:
raise ValueError(
"Failed to authenticate, check the admin password is set right"
)
raise ValueError("Failed to authenticate, check the admin password is set right")
resource_servers = await client.oauth2_rs_list()
print("content:")

2
pykanidm/tests/test_oauth2_checks.py
View file

@ -1,4 +1,4 @@
""" test validation of urls """
"""test validation of urls"""
import pytest

7
pykanidm/tests/test_radius_check_vlan.py
View file

@ -1,5 +1,6 @@
""" tests the check_vlan function """
"""tests the check_vlan function"""
import asyncio
from typing import Any
import pytest
@ -11,9 +12,11 @@ from kanidm.radius.utils import check_vlan
@pytest.mark.asyncio
async def test_check_vlan(event_loop: Any) -> None:
async def test_check_vlan() -> None:
"""test 1"""
# event_loop = asyncio.get_running_loop()
testconfig = KanidmClientConfig.parse_toml(
"""
uri='https://kanidm.example.com'

3
pykanidm/tests/test_radius_config.py
View file

@ -1,4 +1,4 @@
""" tests the config file things """
"""tests the config file things"""
from pathlib import Path
import sys
@ -12,6 +12,7 @@ from kanidm.utils import load_config
EXAMPLE_CONFIG_FILE = Path(__file__).parent.parent.parent / "examples/config"
def test_radius_groups() -> None:
"""testing loading a config file with radius groups defined"""

7
pykanidm/tests/test_radius_token.py
View file

@ -1,5 +1,4 @@
""" testing get_radius_token """
"""testing get_radius_token"""
import json
import logging
@ -22,9 +21,7 @@ async def test_radius_call(client_configfile: KanidmClient) -> None:
print("Doing auth_init using token")
if client_configfile.config.auth_token is None:
pytest.skip(
"You can't test auth if you don't have an auth_token in ~/.config/kanidm"
)
pytest.skip("You can't test auth if you don't have an auth_token in ~/.config/kanidm")
result = await client_configfile.get_radius_token(RADIUS_TEST_USER)
print(f"{result=}")

2
pykanidm/tests/test_session_header.py
View file

@ -1,4 +1,4 @@
""" testing session header function """
"""testing session header function"""
import pytest

9
pykanidm/tests/test_ssl_ca.py
View file

@ -1,5 +1,6 @@
""" tests ssl validation and CA setting etc """
"""tests ssl validation and CA setting etc"""
import logging
from pathlib import Path
from ssl import SSLCertVerificationError
@ -35,7 +36,7 @@ async def test_ssl_self_signed() -> None:
url = "https://self-signed.badssl.com"
print("testing self.?signed cert with defaults and expecting an error")
logging.debug("testing self.?signed cert with defaults and expecting an error")
client = KanidmClient(
uri=url,
)
@ -114,8 +115,10 @@ async def test_ssl_wrong_hostname_verify_certificate() -> None:
@pytest.mark.asyncio
async def test_ssl_revoked() -> None:
"""tests with a revoked certificate"""
logging.basicConfig(level=logging.DEBUG, force=True)
with pytest.raises(aiohttp.ClientConnectorCertificateError):
# TODO: I can't work out why this won't work but.. it's an issue with upstream
# with pytest.raises(aiohttp.ClientConnectorCertificateError):
client = KanidmClient(
uri="https://revoked.badssl.com/",
verify_certificate=True,

2
pykanidm/tests/test_types.py
View file

@ -1,4 +1,4 @@
""" tests types """
"""tests types"""
import pytest
from pydantic import ValidationError

2
pykanidm/tests/testutils.py
View file

@ -1,4 +1,4 @@
""" reusable widgets for testing """
"""reusable widgets for testing"""
from logging import DEBUG, basicConfig, getLogger
from pathlib import Path