Compare commits

...

4 commits

Author SHA1 Message Date
Firstyear 97952d5490
Dont specify config path in container () 2025-05-13 14:30:38 +10:00
Firstyear 6a85e2a21b
Accept SSHA with different salt lengths () 2025-05-13 03:19:12 +00:00
James Hodgkinson 1774f9428c
Bye poetry, hi uv for python things ()
* fix: moving from poetry to uv for python packaging
* fix: updating rlm_python to use uv for things
2025-05-13 02:59:05 +00:00
Firstyear b7eda62e3b
Resolve flaw with ssh key parse if the key has no comment () 2025-05-13 02:39:10 +00:00
33 changed files with 3638 additions and 2755 deletions

View file

@ -63,10 +63,9 @@ jobs:
mv ./target/doc/* ./docs/${{ inputs.tag }}/rustdoc/
- name: pykanidm docs
run: |
python -m pip install poetry
python -m pip install uv
cd pykanidm
poetry install
poetry run mkdocs build
uv run --group docs mkdocs build
cd ..
mv pykanidm/site ./docs/${{ inputs.tag }}/pykanidm
continue-on-error: true

View file

@ -10,32 +10,30 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
tests:
python_tests:
runs-on: ubuntu-latest
env:
UV_LINK_MODE: "copy"
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0 # Fetch all history for .GitInfo and .Lastmod
- name: Install poetry
run: pipx install poetry
- name: Set up Python 3.10
uses: actions/setup-python@v5
with:
python-version: '3.10'
cache: 'poetry'
- name: Install uv
run: pip install --root-user-action=ignore uv
- name: Running mypy
run: |
cd pykanidm
python --version
poetry install
poetry run mypy --strict kanidm tests
uv run mypy --strict kanidm tests
uv run ty check
- name: Running Linting
run: |
cd pykanidm
poetry install
poetry run ruff check kanidm tests
uv run ruff check kanidm tests
- name: Running pytest
run: |
cd pykanidm
poetry install
poetry run pytest -v -m 'not network'
uv run pytest -v -m 'not network'

299
Cargo.lock generated
View file

@ -19,16 +19,16 @@ checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
[[package]]
name = "ahash"
version = "0.8.11"
version = "0.8.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
dependencies = [
"cfg-if",
"getrandom 0.2.16",
"getrandom 0.3.3",
"once_cell",
"serde",
"version_check",
"zerocopy 0.7.35",
"zerocopy",
]
[[package]]
@ -425,9 +425,9 @@ dependencies = [
[[package]]
name = "backtrace"
version = "0.3.74"
version = "0.3.75"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
checksum = "6806a6321ec58106fea15becdad98371e28d92ccbc7c8f1b3b6dd724fe8f1002"
dependencies = [
"addr2line",
"cfg-if",
@ -1680,9 +1680,9 @@ dependencies = [
[[package]]
name = "getrandom"
version = "0.3.2"
version = "0.3.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
dependencies = [
"cfg-if",
"js-sys",
@ -1759,7 +1759,7 @@ dependencies = [
"gix-utils 0.2.0",
"itoa",
"thiserror 2.0.12",
"winnow 0.7.9",
"winnow 0.7.10",
]
[[package]]
@ -1815,7 +1815,7 @@ dependencies = [
"smallvec",
"thiserror 2.0.12",
"unicode-bom",
"winnow 0.7.9",
"winnow 0.7.10",
]
[[package]]
@ -2005,7 +2005,7 @@ dependencies = [
"itoa",
"smallvec",
"thiserror 2.0.12",
"winnow 0.7.9",
"winnow 0.7.10",
]
[[package]]
@ -2061,9 +2061,9 @@ dependencies = [
[[package]]
name = "gix-path"
version = "0.10.17"
version = "0.10.18"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c091d2e887e02c3462f52252c5ea61150270c0f2657b642e8d0d6df56c16e642"
checksum = "567f65fec4ef10dfab97ae71f26a27fd4d7fe7b8e3f90c8a58551c41ff3fb65b"
dependencies = [
"bstr",
"gix-trace",
@ -2089,7 +2089,7 @@ dependencies = [
"gix-utils 0.2.0",
"maybe-async",
"thiserror 2.0.12",
"winnow 0.7.9",
"winnow 0.7.10",
]
[[package]]
@ -2121,7 +2121,7 @@ dependencies = [
"gix-validate 0.9.4",
"memmap2",
"thiserror 2.0.12",
"winnow 0.7.9",
"winnow 0.7.10",
]
[[package]]
@ -2325,9 +2325,9 @@ dependencies = [
[[package]]
name = "h2"
version = "0.4.9"
version = "0.4.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "75249d144030531f8dee69fe9cea04d3edf809a017ae445e2abdff6629e86633"
checksum = "a9421a676d1b147b16b82c9225157dc629087ef8ec4d5e2960f9437a90dac0a5"
dependencies = [
"atomic-waker",
"bytes",
@ -2561,7 +2561,7 @@ dependencies = [
"bytes",
"futures-channel",
"futures-util",
"h2 0.4.9",
"h2 0.4.10",
"http 1.3.1",
"http-body 1.0.1",
"httparse",
@ -2589,7 +2589,7 @@ dependencies = [
"tokio",
"tokio-rustls",
"tower-service",
"webpki-roots",
"webpki-roots 0.26.11",
]
[[package]]
@ -2667,21 +2667,22 @@ dependencies = [
[[package]]
name = "icu_collections"
version = "1.5.0"
version = "2.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "db2fa452206ebee18c4b5c2274dbf1de17008e874b4dc4f0aea9d01ca79e4526"
checksum = "200072f5d0e3614556f94a9930d5dc3e0662a652823904c3a75dc3b0af7fee47"
dependencies = [
"displaydoc",
"potential_utf",
"yoke",
"zerofrom",
"zerovec",
]
[[package]]
name = "icu_locid"
version = "1.5.0"
name = "icu_locale_core"
version = "2.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "13acbb8371917fc971be86fc8057c41a64b521c184808a698c02acc242dbf637"
checksum = "0cde2700ccaed3872079a65fb1a78f6c0a36c91570f28755dda67bc8f7d9f00a"
dependencies = [
"displaydoc",
"litemap",
@ -2690,31 +2691,11 @@ dependencies = [
"zerovec",
]
[[package]]
name = "icu_locid_transform"
version = "1.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "01d11ac35de8e40fdeda00d9e1e9d92525f3f9d887cdd7aa81d727596788b54e"
dependencies = [
"displaydoc",
"icu_locid",
"icu_locid_transform_data",
"icu_provider",
"tinystr",
"zerovec",
]
[[package]]
name = "icu_locid_transform_data"
version = "1.5.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7515e6d781098bf9f7205ab3fc7e9709d34554ae0b21ddbcb5febfa4bc7df11d"
[[package]]
name = "icu_normalizer"
version = "1.5.0"
version = "2.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "19ce3e0da2ec68599d193c93d088142efd7f9c5d6fc9b803774855747dc6a84f"
checksum = "436880e8e18df4d7bbc06d58432329d6458cc84531f7ac5f024e93deadb37979"
dependencies = [
"displaydoc",
"icu_collections",
@ -2722,67 +2703,54 @@ dependencies = [
"icu_properties",
"icu_provider",
"smallvec",
"utf16_iter",
"utf8_iter",
"write16",
"zerovec",
]
[[package]]
name = "icu_normalizer_data"
version = "1.5.1"
version = "2.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c5e8338228bdc8ab83303f16b797e177953730f601a96c25d10cb3ab0daa0cb7"
checksum = "00210d6893afc98edb752b664b8890f0ef174c8adbb8d0be9710fa66fbbf72d3"
[[package]]
name = "icu_properties"
version = "1.5.1"
version = "2.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "93d6020766cfc6302c15dbbc9c8778c37e62c14427cb7f6e601d849e092aeef5"
checksum = "2549ca8c7241c82f59c80ba2a6f415d931c5b58d24fb8412caa1a1f02c49139a"
dependencies = [
"displaydoc",
"icu_collections",
"icu_locid_transform",
"icu_locale_core",
"icu_properties_data",
"icu_provider",
"tinystr",
"potential_utf",
"zerotrie",
"zerovec",
]
[[package]]
name = "icu_properties_data"
version = "1.5.1"
version = "2.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "85fb8799753b75aee8d2a21d7c14d9f38921b54b3dbda10f5a3c7a7b82dba5e2"
checksum = "8197e866e47b68f8f7d95249e172903bec06004b18b2937f1095d40a0c57de04"
[[package]]
name = "icu_provider"
version = "1.5.0"
version = "2.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6ed421c8a8ef78d3e2dbc98a973be2f3770cb42b606e3ab18d6237c4dfde68d9"
checksum = "03c80da27b5f4187909049ee2d72f276f0d9f99a42c306bd0131ecfe04d8e5af"
dependencies = [
"displaydoc",
"icu_locid",
"icu_provider_macros",
"icu_locale_core",
"stable_deref_trait",
"tinystr",
"writeable",
"yoke",
"zerofrom",
"zerotrie",
"zerovec",
]
[[package]]
name = "icu_provider_macros"
version = "1.5.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
dependencies = [
"proc-macro2",
"quote",
"syn 2.0.101",
]
[[package]]
name = "ident_case"
version = "1.0.1"
@ -2813,9 +2781,9 @@ dependencies = [
[[package]]
name = "idna_adapter"
version = "1.2.0"
version = "1.2.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "daca1df1c957320b2cf139ac61e7bd64fed304c5040df000a745aa1de3b4ef71"
checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
dependencies = [
"icu_normalizer",
"icu_properties",
@ -2927,9 +2895,9 @@ checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
[[package]]
name = "jiff"
version = "0.2.11"
version = "0.2.13"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "27e77966151130221b079bcec80f1f34a9e414fa489d99152a201c07fd2182bc"
checksum = "f02000660d30638906021176af16b17498bd0d12813dbfe7b276d8bc7f3c0806"
dependencies = [
"jiff-static",
"jiff-tzdb-platform",
@ -2942,9 +2910,9 @@ dependencies = [
[[package]]
name = "jiff-static"
version = "0.2.11"
version = "0.2.13"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "97265751f8a9a4228476f2fc17874a9e7e70e96b893368e42619880fe143b48a"
checksum = "f3c30758ddd7188629c6713fc45d1188af4f44c90582311d0c8d8c9907f60c48"
dependencies = [
"proc-macro2",
"quote",
@ -3429,9 +3397,9 @@ dependencies = [
[[package]]
name = "kqueue"
version = "1.0.8"
version = "1.1.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "7447f1ca1b7b563588a205fe93dea8df60fd981423a768bc1c0ded35ed147d0c"
checksum = "eac30106d7dce88daf4a3fcb4879ea939476d5074a9b7ddd0fb97fa4bed5596a"
dependencies = [
"kqueue-sys",
"libc",
@ -3449,9 +3417,9 @@ dependencies = [
[[package]]
name = "lambert_w"
version = "1.2.17"
version = "1.2.19"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "dc66ddcab7f8a3cc035052b0bb1f9f7f47ac92741b3fe78974bdd356fe023a40"
checksum = "a3269cd75481b02173ffe6cb30f08e3eae78b20eb2ed6bfbdb3ce2a90446d83f"
dependencies = [
"num-complex",
"num-traits",
@ -3525,19 +3493,19 @@ checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
[[package]]
name = "libloading"
version = "0.8.6"
version = "0.8.7"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "fc2f4eb4bc735547cfed7c0a4922cbd04a4655978c09b54f1f7b228750664c34"
checksum = "6a793df0d7afeac54f95b471d3af7f0d4fb975699f972341a4b76988d49cdf0c"
dependencies = [
"cfg-if",
"windows-targets 0.52.6",
"windows-targets 0.53.0",
]
[[package]]
name = "libm"
version = "0.2.13"
version = "0.2.15"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c9627da5196e5d8ed0b0495e61e518847578da83483c37288316d9b2e03a7f72"
checksum = "f9fbbcab51052fe104eb5e5d351cf728d30a5be1fe14d9be8a3b097481fb97de"
[[package]]
name = "libmimalloc-sys"
@ -3615,9 +3583,9 @@ checksum = "cd945864f07fe9f5371a27ad7b52a172b4b499999f1d97574c9fa68373937e12"
[[package]]
name = "litemap"
version = "0.7.5"
version = "0.8.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "23fb14cb19457329c82206317a5663005a4d404783dc74f4252769b0d5f42856"
checksum = "241eaef5fd12c88705a01fc1066c48c4b36e0dd4377dcdc7ec3942cea7a69956"
[[package]]
name = "litrs"
@ -3671,6 +3639,12 @@ dependencies = [
"hashbrown 0.15.3",
]
[[package]]
name = "lru-slab"
version = "0.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
[[package]]
name = "malloced"
version = "1.3.1"
@ -3705,9 +3679,9 @@ dependencies = [
[[package]]
name = "matrixmultiply"
version = "0.3.9"
version = "0.3.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9380b911e3e96d10c1f415da0876389aaf1b56759054eeb0de7df940c456ba1a"
checksum = "a06de3016e9fae57a36fd14dba131fccf49f74b40b7fbdb472f96e361ec71a08"
dependencies = [
"autocfg",
"num_cpus",
@ -3864,9 +3838,9 @@ dependencies = [
[[package]]
name = "nix"
version = "0.30.0"
version = "0.30.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "537bc3c4a347b87fd52ac6c03a02ab1302962cfd93373c5d7a112cdc337854cc"
checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
dependencies = [
"bitflags 2.9.0",
"cfg-if",
@ -4542,6 +4516,15 @@ dependencies = [
"portable-atomic",
]
[[package]]
name = "potential_utf"
version = "0.1.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e5a7c30837279ca13e7c867e9e40053bc68740f988cb07f7ca6df43cc734b585"
dependencies = [
"zerovec",
]
[[package]]
name = "powerfmt"
version = "0.2.0"
@ -4554,7 +4537,7 @@ version = "0.2.21"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
dependencies = [
"zerocopy 0.8.25",
"zerocopy",
]
[[package]]
@ -4685,9 +4668,9 @@ checksum = "a993555f31e5a609f617c12db6250dedcac1b0a85076912c436e6fc9b2c8e6a3"
[[package]]
name = "quinn"
version = "0.11.7"
version = "0.11.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c3bd15a6f2967aef83887dcb9fec0014580467e33720d073560cf015a5683012"
checksum = "626214629cda6781b6dc1d316ba307189c85ba657213ce642d9c77670f8202c8"
dependencies = [
"bytes",
"cfg_aliases",
@ -4705,12 +4688,13 @@ dependencies = [
[[package]]
name = "quinn-proto"
version = "0.11.11"
version = "0.11.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bcbafbbdbb0f638fe3f35f3c56739f77a8a1d070cb25603226c83339b391472b"
checksum = "49df843a9161c85bb8aae55f101bc0bac8bcafd637a620d9122fd7e0b2f7422e"
dependencies = [
"bytes",
"getrandom 0.3.2",
"getrandom 0.3.3",
"lru-slab",
"rand 0.9.1",
"ring",
"rustc-hash 2.1.1",
@ -4808,7 +4792,7 @@ version = "0.9.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
dependencies = [
"getrandom 0.3.2",
"getrandom 0.3.3",
]
[[package]]
@ -4819,9 +4803,9 @@ checksum = "60a357793950651c4ed0f3f52338f53b2f809f32d83a07f72909fa13e4c6c1e3"
[[package]]
name = "redox_syscall"
version = "0.5.11"
version = "0.5.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d2f103c6d277498fbceb16e84d317e2a400f160f46904d5f5410848c829511a3"
checksum = "928fca9cf2aa042393a8325b9ead81d2f0df4cb12e1e24cef072922ccd99c5af"
dependencies = [
"bitflags 2.9.0",
]
@ -4965,7 +4949,7 @@ dependencies = [
"futures-channel",
"futures-core",
"futures-util",
"h2 0.4.9",
"h2 0.4.10",
"http 1.3.1",
"http-body 1.0.1",
"http-body-util",
@ -4998,7 +4982,7 @@ dependencies = [
"wasm-bindgen",
"wasm-bindgen-futures",
"web-sys",
"webpki-roots",
"webpki-roots 0.26.11",
"windows-registry",
]
@ -5057,9 +5041,9 @@ dependencies = [
[[package]]
name = "rust-embed"
version = "8.7.0"
version = "8.7.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e5fbc0ee50fcb99af7cebb442e5df7b5b45e9460ffa3f8f549cd26b862bec49d"
checksum = "60e425e204264b144d4c929d126d0de524b40a961686414bab5040f7465c71be"
dependencies = [
"rust-embed-impl",
"rust-embed-utils",
@ -5179,11 +5163,12 @@ dependencies = [
[[package]]
name = "rustls-pki-types"
version = "1.11.0"
version = "1.12.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "917ce264624a4b4db1c364dcc35bfca9ded014d0a958cd47ad3e960e988ea51c"
checksum = "229a4a4c221013e7e1f1a043678c5cc39fe5171437c88fb47151a21e6f5b5c79"
dependencies = [
"web-time",
"zeroize",
]
[[package]]
@ -5641,7 +5626,7 @@ dependencies = [
[[package]]
name = "sshkeys"
version = "0.3.3"
source = "git+https://github.com/Firstyear/rust-sshkeys.git?rev=3a081cbf7480628223bcb96fc8aaa8c19109d007#3a081cbf7480628223bcb96fc8aaa8c19109d007"
source = "git+https://github.com/Firstyear/rust-sshkeys.git?rev=49cb53232115d3aea86cd059b151e376293805fc#49cb53232115d3aea86cd059b151e376293805fc"
dependencies = [
"base64 0.22.1",
"byteorder",
@ -5761,7 +5746,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e8a64e3985349f2441a1a9ef0b853f869006c3855f2cda6862a94d26ebb9d6a1"
dependencies = [
"fastrand",
"getrandom 0.3.2",
"getrandom 0.3.3",
"once_cell",
"rustix 1.0.7",
"windows-sys 0.59.0",
@ -5876,9 +5861,9 @@ dependencies = [
[[package]]
name = "tinystr"
version = "0.7.6"
version = "0.8.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f"
checksum = "5d4f6d1145dcb577acf783d4e601bc1d76a13337bb54e6233add580b07344c8b"
dependencies = [
"displaydoc",
"zerovec",
@ -6037,7 +6022,7 @@ dependencies = [
"serde_spanned",
"toml_datetime",
"toml_write",
"winnow 0.7.9",
"winnow 0.7.10",
]
[[package]]
@ -6057,7 +6042,7 @@ dependencies = [
"axum",
"base64 0.22.1",
"bytes",
"h2 0.4.9",
"h2 0.4.10",
"http 1.3.1",
"http-body 1.0.1",
"http-body-util",
@ -6358,12 +6343,6 @@ version = "2.1.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
[[package]]
name = "utf16_iter"
version = "1.0.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
[[package]]
name = "utf8_iter"
version = "1.0.4"
@ -6425,7 +6404,7 @@ version = "1.16.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "458f7a779bf54acc9f347480ac654f68407d3aab21269a6e3c9f922acd9e2da9"
dependencies = [
"getrandom 0.3.2",
"getrandom 0.3.3",
"serde",
]
@ -6718,9 +6697,18 @@ dependencies = [
[[package]]
name = "webpki-roots"
version = "0.26.10"
version = "0.26.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "37493cadf42a2a939ed404698ded7fb378bf301b5011f973361779a3a74f8c93"
checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
dependencies = [
"webpki-roots 1.0.0",
]
[[package]]
name = "webpki-roots"
version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2853738d1cc4f2da3a225c18ec6c3721abb31961096e9dbf5ab35fa88b19cfdb"
dependencies = [
"rustls-pki-types",
]
@ -7144,9 +7132,9 @@ dependencies = [
[[package]]
name = "winnow"
version = "0.7.9"
version = "0.7.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d9fb597c990f03753e08d3c29efbfcf2019a003b4bf4ba19225c158e1549f0f3"
checksum = "c06928c8748d81b05c9be96aad92e1b6ff01833332f281e8cfca3be4b35fc9ec"
dependencies = [
"memchr",
]
@ -7170,17 +7158,11 @@ dependencies = [
"bitflags 2.9.0",
]
[[package]]
name = "write16"
version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
[[package]]
name = "writeable"
version = "0.5.5"
version = "0.6.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
checksum = "ea2f10b9bb0928dfb1b42b65e1f9e36f7f54dbdf08457afefb38afcdec4fa2bb"
[[package]]
name = "x509-cert"
@ -7213,9 +7195,9 @@ dependencies = [
[[package]]
name = "yoke"
version = "0.7.5"
version = "0.8.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "120e6aef9aa629e3d4f52dc8cc43a015c7724194c97dfaf45180d2daf2b77f40"
checksum = "5f41bb01b8226ef4bfd589436a297c53d118f65921786300e427be8d487695cc"
dependencies = [
"serde",
"stable_deref_trait",
@ -7225,9 +7207,9 @@ dependencies = [
[[package]]
name = "yoke-derive"
version = "0.7.5"
version = "0.8.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
checksum = "38da3c9736e16c5d3c8c597a9aaa5d1fa565d0532ae05e27c24aa62fb32c0ab6"
dependencies = [
"proc-macro2",
"quote",
@ -7235,33 +7217,13 @@ dependencies = [
"synstructure",
]
[[package]]
name = "zerocopy"
version = "0.7.35"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
dependencies = [
"zerocopy-derive 0.7.35",
]
[[package]]
name = "zerocopy"
version = "0.8.25"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a1702d9583232ddb9174e01bb7c15a2ab8fb1bc6f227aa1233858c351a3ba0cb"
dependencies = [
"zerocopy-derive 0.8.25",
]
[[package]]
name = "zerocopy-derive"
version = "0.7.35"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
dependencies = [
"proc-macro2",
"quote",
"syn 2.0.101",
"zerocopy-derive",
]
[[package]]
@ -7317,10 +7279,21 @@ dependencies = [
]
[[package]]
name = "zerovec"
version = "0.10.4"
name = "zerotrie"
version = "0.2.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "aa2b893d79df23bfb12d5461018d408ea19dfafe76c2c7ef6d4eba614f8ff079"
checksum = "36f0bbd478583f79edad978b407914f61b2972f5af6fa089686016be8f9af595"
dependencies = [
"displaydoc",
"yoke",
"zerofrom",
]
[[package]]
name = "zerovec"
version = "0.11.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4a05eb080e015ba39cc9e23bbe5e7fb04d5fb040350f99f34e338d5fdd294428"
dependencies = [
"yoke",
"zerofrom",
@ -7329,9 +7302,9 @@ dependencies = [
[[package]]
name = "zerovec-derive"
version = "0.10.3"
version = "0.11.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
checksum = "5b96237efa0c878c64bd89c436f661be4e46b2f3eff1ebb976f7ef2321d2f58f"
dependencies = [
"proc-macro2",
"quote",

View file

@ -121,7 +121,7 @@ codegen-units = 256
# For BSD nss support
libnss = { git = "https://github.com/Firstyear/libnss-rs.git", branch = "20250207-freebsd" }
# Allow ssh keys to have comments with spaces.
sshkeys = { git = "https://github.com/Firstyear/rust-sshkeys.git", rev = "3a081cbf7480628223bcb96fc8aaa8c19109d007" }
sshkeys = { git = "https://github.com/Firstyear/rust-sshkeys.git", rev = "49cb53232115d3aea86cd059b151e376293805fc" }
# Branch currently carrying some needed rs256 signer patches for jwk handling,
# as main is currently working to drop openssl and may need more work before
# we commit to that change here.

View file

@ -170,7 +170,7 @@ codespell:
codespell -c \
-D .codespell_dictionary \
--ignore-words .codespell_ignore \
--skip='./target,./pykanidm/.venv,./pykanidm/.mypy_cache,./.mypy_cache,./pykanidm/poetry.lock' \
--skip='./target,./pykanidm/.venv,./pykanidm/.mypy_cache,./.mypy_cache,./pykanidm/uv.lock' \
--skip='./book/*.js' \
--skip='./book/book/*' \
--skip='./book/src/images/*' \
@ -184,21 +184,17 @@ codespell:
.PHONY: test/pykanidm/pytest
test/pykanidm/pytest: ## python library testing
cd pykanidm && \
poetry install && \
poetry run pytest -vv
uv run pytest -vv
.PHONY: test/pykanidm/lint
test/pykanidm/lint: ## python library linting
cd pykanidm && \
poetry install && \
poetry run ruff check tests kanidm
uv run ruff check tests kanidm
.PHONY: test/pykanidm/mypy
test/pykanidm/mypy: ## python library type checking
cd pykanidm && \
poetry install && \
echo "Running mypy" && \
poetry run mypy --strict tests kanidm
uv run mypy --strict tests kanidm
.PHONY: test/pykanidm
test/pykanidm: ## run the kanidm python module test suite (mypy/lint/pytest)
@ -261,15 +257,13 @@ clean_book:
docs/pykanidm/build: ## Build the mkdocs
docs/pykanidm/build:
cd pykanidm && \
poetry install && \
poetry run mkdocs build
uv run --group docs mkdocs build
.PHONY: docs/pykanidm/serve
docs/pykanidm/serve: ## Run the local mkdocs server
docs/pykanidm/serve:
cd pykanidm && \
poetry install && \
poetry run mkdocs serve
uv run --group docs mkdocs serve
########################################################################

View file

@ -11,13 +11,13 @@ So far it includes:
TODO: a lot of things.
## Setting up your dev environment.
## Setting up your dev environment
Setting up a dev environment can be a little complex because of the mono-repo.
1. Install poetry: `python -m pip install poetry`. This is what we use to manage the packages, and
1. Install uv: `python -m pip install uv`. This is what we use to manage the packages, and
allows you to set up virtual python environments easier.
2. Build the base environment. From within the `pykanidm` directory, run: `poetry install` This'll
2. Build the base environment. From within the `pykanidm` directory, run: `uv sync` This'll
set up a virtual environment and install all the required packages (and development-related ones)
3. Start editing!

View file

@ -2,10 +2,10 @@
Setting up a dev environment has some extra complexity due to the mono-repo design.
1. Install poetry: `python -m pip install poetry`. This is what we use to manage the packages, and
1. Install uv: `python -m pip install uv`. This is what we use to manage the packages, and
allows you to set up virtual python environments easier.
2. Build the base environment. From within the kanidm_rlm_python directory, run: `poetry install`
3. Install the `kanidm` python library: `poetry run python -m pip install ../pykanidm`
2. Build the base environment. From within the kanidm_rlm_python directory, run: `uv sync`
3. Install the `kanidm` python library: `uv run python -m pip install ../pykanidm`
4. Start editing!
Most IDEs will be happier if you open the `kanidm_rlm_python` or `pykanidm` directories as the base

View file

@ -52,7 +52,6 @@ const PBKDF2_KEY_LEN: usize = 32;
const PBKDF2_MIN_NIST_KEY_LEN: usize = 32;
const PBKDF2_SHA1_MIN_KEY_LEN: usize = 19;
const DS_SHA_SALT_LEN: usize = 8;
const DS_SHA1_HASH_LEN: usize = 20;
const DS_SHA256_HASH_LEN: usize = 32;
const DS_SHA512_HASH_LEN: usize = 64;
@ -618,10 +617,8 @@ impl TryFrom<&str> for Password {
.or_else(|| value.strip_prefix("{ssha}"))
{
let sh = general_purpose::STANDARD.decode(ds_ssha1).map_err(|_| ())?;
let (h, s) = sh.split_at(DS_SHA1_HASH_LEN);
if s.len() != DS_SHA_SALT_LEN {
return Err(());
}
let (h, s) = sh.split_at_checked(DS_SHA1_HASH_LEN).ok_or(())?;
return Ok(Password {
material: Kdf::SSHA1(s.to_vec(), h.to_vec()),
});
@ -649,10 +646,8 @@ impl TryFrom<&str> for Password {
let sh = general_purpose::STANDARD
.decode(ds_ssha256)
.map_err(|_| ())?;
let (h, s) = sh.split_at(DS_SHA256_HASH_LEN);
if s.len() != DS_SHA_SALT_LEN {
return Err(());
}
let (h, s) = sh.split_at_checked(DS_SHA256_HASH_LEN).ok_or(())?;
return Ok(Password {
material: Kdf::SSHA256(s.to_vec(), h.to_vec()),
});
@ -680,10 +675,8 @@ impl TryFrom<&str> for Password {
let sh = general_purpose::STANDARD
.decode(ds_ssha512)
.map_err(|_| ())?;
let (h, s) = sh.split_at(DS_SHA512_HASH_LEN);
if s.len() != DS_SHA_SALT_LEN {
return Err(());
}
let (h, s) = sh.split_at_checked(DS_SHA512_HASH_LEN).ok_or(())?;
return Ok(Password {
material: Kdf::SSHA512(s.to_vec(), h.to_vec()),
});
@ -1404,9 +1397,15 @@ mod tests {
#[test]
fn test_password_from_ds_ssha512() {
// from #3615
let im_pw = "{SSHA512}SvpKVQPfDUw7DbVFLVdhFUj33qx2zwkCNyfdRUEvYTloJt15HDVfhHzx6HLaKFUPBOCa/6D8lDnrybYzW+xSQC2GXBvYpn3ScVEcC+oH20I=";
let _r = Password::try_from(im_pw).expect("Failed to parse");
// Valid hash to import
let im_pw = "{SSHA512}JwrSUHkI7FTAfHRVR6KoFlSN0E3dmaQWARjZ+/UsShYlENOqDtFVU77HJLLrY2MuSp0jve52+pwtdVl2QUAHukQ0XUf5LDtM";
let _r = Password::try_from(im_pw).expect("Failed to parse");
// allow lower case of the hash type
let im_pw = "{ssha512}JwrSUHkI7FTAfHRVR6KoFlSN0E3dmaQWARjZ+/UsShYlENOqDtFVU77HJLLrY2MuSp0jve52+pwtdVl2QUAHukQ0XUf5LDtM";
let password = "password";
let r = Password::try_from(im_pw).expect("Failed to parse");

View file

@ -15,14 +15,14 @@ python -m pip install kanidm
Documentation can be generated by [cloning the repository](https://github.com/kanidm/kanidm) and
running `make docs/pykanidm/build`. The documentation will appear in `./pykanidm/site`. You'll need
make and the [poetry](https://pypi.org/project/poetry/) package installed.
make and the [uv](https://pypi.org/project/uv/) package installed.
## Testing
Set up your dev environment using `poetry` - `python -m pip install poetry && poetry install`.
Set up your dev environment using `uv` - `python -m pip install uv && uv sync`.
Pytest it used for testing, if you don't have a live server to test against and config set up, use
`poetry run pytest -m 'not network'`.
`uv run pytest -m 'not network'`.
## Changelog
@ -31,3 +31,4 @@ Pytest it used for testing, if you don't have a live server to test against and
| 0.0.1 | 2022-08-16 | Initial release |
| 0.0.2 | 2022-08-16 | Updated license, including test code in package |
| 0.0.3 | 2022-08-17 | Updated test suite to allow skipping of network tests |
| 1.2.0 | 2025-05-13 | Replaced poetry with uv for packaging |

View file

@ -12,6 +12,7 @@ import ssl
from typing import Any, Dict, List, Optional, Tuple, Union
import aiohttp
import aiohttp.client
from pydantic import ValidationError
import yarl
@ -528,7 +529,7 @@ class KanidmClient:
response: ClientResponse[IOauth2Rs] = await self.call_get(endpoint)
if response.status_code != 200 or response.data is None:
raise ValueError(f"Failed to get oauth2 resource server: {response.content}")
return RawOAuth2Rs(**response.data).as_oauth2_rs
return RawOAuth2Rs.model_validate(response.data).as_oauth2_rs
async def oauth2_rs_secret_get(self, rs_name: str) -> str:
"""get an OAuth2 client secret"""
@ -588,7 +589,7 @@ class KanidmClient:
response: ClientResponse[IServiceAccount] = await self.call_get(endpoint)
if response.status_code != 200 or response.data is None:
raise ValueError(f"Failed to get service account: {response.content}")
return RawServiceAccount(**response.data).as_service_account
return RawServiceAccount.model_validate(response.data).as_service_account
async def service_account_create(self, name: str, displayname: str) -> ClientResponse[None]:
"""Create a service account"""
@ -675,7 +676,7 @@ class KanidmClient:
response: ClientResponse[IGroup] = await self.call_get(endpoint)
if response.status_code != 200 or response.data is None:
raise ValueError(f"Failed to get group: {response.content}")
return RawGroup(**response.data).as_group
return RawGroup.model_validate(response.data).as_group
async def group_create(self, name: str) -> ClientResponse[None]:
"""Create a group"""
@ -720,7 +721,7 @@ class KanidmClient:
response: ClientResponse[IPerson] = await self.call_get(endpoint)
if response.status_code != 200 or response.data is None:
raise ValueError(f"Failed to get person: {response.content}")
return RawPerson(**response.data).as_person
return RawPerson.model_validate(response.data).as_person
async def person_account_create(self, name: str, displayname: str) -> ClientResponse[None]:
"""Create a person account"""

View file

@ -49,13 +49,13 @@ def instantiate(_: Any) -> Any:
if config_path is None:
logging.error("Failed to find configuration file, checked (%s), quitting!", CONFIG_PATHS)
sys.exit(1)
kanidm_client = KanidmClient(config_file=config_path)
if kanidm_client.config.auth_token is None:
logging.error("You need to specify auth_token in the configuration file!")
sys.exit(1)
os.environ["KANIDM_CONFIG_FILE"] = config_path.as_posix()
logging.info("Config file: %s", config_path.as_posix())
else:
kanidm_client = KanidmClient(config_file=config_path)
if kanidm_client.config.auth_token is None:
logging.error("You need to specify auth_token in the configuration file!")
sys.exit(1)
os.environ["KANIDM_CONFIG_FILE"] = config_path.as_posix()
logging.info("Config file: %s", os.environ["KANIDM_CONFIG_FILE"])
return radiusd.RLM_MODULE_OK

2409
pykanidm/poetry.lock generated

File diff suppressed because it is too large Load diff

View file

@ -1,18 +1,21 @@
[tool.poetry]
[project]
authors = [{ name = "James Hodgkinson", email = "james@terminaloutcomes.com" }]
license = { text = "MPL-2.0" }
requires-python = "<4.0,>=3.9"
dependencies = [
"toml>=0.10.2",
"pydantic>=2.0.0",
"aiohttp>=3.8.1",
"Authlib>=1.2.0",
]
name = "kanidm"
version = "1.0.1"
description = "Kanidm client library"
license = "MPL-2.0"
authors = ["James Hodgkinson <james@terminaloutcomes.com>"]
version = "1.2.0"
readme = "README.md"
repository = "https://github.com/kanidm/kanidm"
homepage = "https://kanidm.com/"
packages = [{ include = "kanidm" }]
keywords = ["kanidm", "idm", "api"]
classifiers = [
"Development Status :: 3 - Alpha",
"Programming Language :: Python :: 3",
@ -20,40 +23,47 @@ classifiers = [
"Programming Language :: Python :: 3.10",
"Operating System :: OS Independent",
]
[tool.poetry.dependencies]
python = "^3.9"
toml = "^0.10.2"
pydantic = ">=2.0.0,<3.0.0"
aiohttp = "^3.8.1"
Authlib = "^1.2.0"
[project.urls]
homepage = "https://kanidm.com/"
repository = "https://github.com/kanidm/kanidm"
[tool.poetry.group.dev.dependencies]
ruff = ">=0.5.1,<0.11.10"
pytest = "^8.3.4"
mypy = "^1.14.1"
types-requests = "^2.32.0.20241016"
pytest-aiohttp = "^1.1.0"
pytest-mock = "^3.14.0"
types-toml = "^0.10.8.20240310"
pylint-pydantic = "^0.3.5"
coverage = "^7.6.10"
mkdocs = "^1.6.1"
mkdocs-material = "^9.6.1"
mkdocstrings = ">=0.27,<0.30"
mkdocstrings-python = "^1.13.0"
pook = "^2.1.3"
[dependency-groups]
dev = [
"ruff>=0.5.1",
"pytest>=8.3.4",
"mypy>=1.14.1,<2.0.0",
"types-requests>=2.32.0.20241016",
"pytest-aiohttp>=1.1.0",
"pytest-mock>=3.14.0",
"types-toml>=0.10.8.20240310",
"pylint-pydantic>=0.3.5",
"coverage>=7.6.10",
"pook>=2.1.3",
"ty>=0.0.0a8",
]
docs = [
"mkdocs>=1.6.1",
"mkdocs-material>=9.6.13",
"mkdocstrings>=0.29.1",
"mkdocstrings-python>=1.16.10",
]
[build-system]
requires = ["poetry-core>=1.0.0"]
build-backend = "poetry.core.masonry.api"
requires = ["pdm-backend"]
build-backend = "pdm.backend"
[tool.pylint.MASTER]
max-line-length = 150
disable = "W0511,raise-missing-from"
extension-pkg-allow-list = "pydantic"
# https://github.com/samuelcolvin/pydantic/issues/1961#issuecomment-759522422
load-plugins = "pylint_pydantic,pylint_pytest"
[tool.pdm.build]
includes = ["kanidm"]
# [tool.pylint.MASTER]
# max-line-length = 150
# disable = "W0511,raise-missing-from"
# extension-pkg-allow-list = "pydantic"
# # https://github.com/samuelcolvin/pydantic/issues/1961#issuecomment-759522422
# load-plugins = "pylint_pydantic,pylint_pytest"
[tool.ruff]
line-length = 150
@ -64,9 +74,9 @@ line-length = 150
"F811", # pytest fixtures
]
[tool.pytest.ini_options]
asyncio_mode = "auto"
asyncio_default_fixture_loop_scope = "function"
markers = [
"network: Tests that require network access and a working backend server",
"interactive: Requires specific config and a working backend server",
@ -77,4 +87,6 @@ source = ["kanidm"]
omit = ["tests"]
[tool.mypy]
strict = true
plugins = "pydantic.mypy"
disable_error_code = "unused-ignore"

View file

@ -1,5 +1,5 @@
#!/bin/bash
poetry run coverage run -m pytest -vvx && \
poetry run coverage html
uv run coverage run -m pytest -vvx && \
uv run coverage html

View file

View file

@ -7,7 +7,7 @@ import pytest
from pytest_mock import MockerFixture
# pylint: disable=unused-import
from testutils import client, client_configfile, MockResponse
from .testutils import client, client_configfile, MockResponse
from kanidm import KanidmClient
from kanidm.exceptions import AuthCredFailed, AuthInitFailed
@ -25,9 +25,11 @@ async def test_auth_init(client_configfile: KanidmClient) -> None:
print("Starting client...")
print(f"Doing auth_init for {client_configfile.config.username}")
if client_configfile.config.username is None:
pytest.skip("Can't run auth test without a username/password")
result = await client_configfile.auth_init(client_configfile.config.username)
username = client_configfile.config.username
if username is None:
raise pytest.skip("Can't run auth test without a username/password") # type: ignore[call-non-callable]
result = await client_configfile.auth_init(username)
print(f"{result=}")
print(result.model_dump_json())
assert result.sessionid
@ -39,9 +41,11 @@ async def test_auth_begin(client_configfile: KanidmClient) -> None:
"""tests the auth begin step"""
print(f"Doing auth_init for {client_configfile.config.username}")
if client_configfile.config.username is None:
pytest.skip("Can't run auth test without a username/password")
result = await client_configfile.auth_init(client_configfile.config.username)
username = client_configfile.config.username
if username is None:
raise pytest.skip("Can't run auth test without a username/password") # type: ignore[call-non-callable]
result = await client_configfile.auth_init(username)
print(f"{result=}")
print("Result dict:")
print(result.model_dump_json())
@ -60,7 +64,7 @@ async def test_auth_begin(client_configfile: KanidmClient) -> None:
retval = begin_result.data
if retval is None:
raise pytest.fail("Failed to do begin_result")
raise pytest.fail("Failed to do begin_result") # type: ignore[call-non-callable]
retval["response"] = begin_result.model_dump()
@ -72,7 +76,7 @@ async def test_auth_begin(client_configfile: KanidmClient) -> None:
async def test_authenticate_flow(client_configfile: KanidmClient) -> None:
"""tests the authenticate() flow"""
if client_configfile.config.username is None or client_configfile.config.password is None:
pytest.skip("Can't run this without a username and password set in the config file")
pytest.skip("Can't run this without a username and password set in the config file") # type: ignore[call-non-callable]
client_configfile.config.auth_token = None
print(f"Doing client.authenticate for {client_configfile.config.username}")
@ -96,10 +100,10 @@ async def test_authenticate_anonymous(client_configfile: KanidmClient) -> None:
async def test_authenticate_flow_fail(client_configfile: KanidmClient) -> None:
"""tests the authenticate() flow with a valid (hopefully) username and invalid password"""
if not bool(os.getenv("RUN_SCARY_TESTS", None)):
pytest.skip(reason="Skipping because env var RUN_SCARY_TESTS isn't set")
pytest.skip("Skipping because env var RUN_SCARY_TESTS isn't set") # type: ignore[call-non-callable]
print("Starting client...")
if client_configfile.config.uri is None or client_configfile.config.username is None or client_configfile.config.password is None:
pytest.skip("Please ensure you have a username, password and uri in the config")
pytest.skip("Please ensure you have a username, password and uri in the config") # type: ignore[call-non-callable]
print(f"Doing client.authenticate for {client_configfile.config.username}")
client_configfile.config.auth_token = None

View file

@ -27,8 +27,7 @@ async def client() -> KanidmClient:
def test_load_config_file() -> None:
"""tests that the file loads"""
if not Path(EXAMPLE_CONFIG_FILE).expanduser().resolve().exists():
print("Can't find client config file", file=sys.stderr)
pytest.skip()
pytest.skip(f"Can't find client config file {EXAMPLE_CONFIG_FILE}") # type: ignore[call-non-callable]
print("Loading config file")
config = load_config(EXAMPLE_CONFIG_FILE)
assert config.get("uri") == "https://localhost:8443"

View file

@ -69,7 +69,7 @@ def test_tokenstuff() -> None:
info = token_store.token_info("idm_admin")
print(f"Parsed token: {info}")
if info is None:
pytest.skip()
pytest.skip("No token!") # type: ignore[call-non-callable]
print(info.expiry_datetime)
assert (
datetime(

View file

@ -16,7 +16,7 @@ async def client() -> KanidmClient:
config_file=Path(__file__).parent.parent.parent / "examples/config_localhost",
)
except FileNotFoundError as error:
raise pytest.skip(f"File not found: {error}")
pytest.skip(f"File not found: {error}") # type: ignore[call-non-callable]
return client
@ -32,7 +32,7 @@ async def test_oauth2_rs_list(client: KanidmClient) -> None:
password = os.getenv("KANIDM_PASSWORD")
if password is None:
print("No KANIDM_PASSWORD env var set for testing")
raise pytest.skip("No KANIDM_PASSWORD env var set for testing")
pytest.skip("No KANIDM_PASSWORD env var set for testing") # type: ignore[call-non-callable]
auth_resp = await client.authenticate_password(username, password, update_internal_auth_token=True)
if auth_resp.state is None:

View file

@ -6,7 +6,7 @@ import logging
import pytest
# pylint: disable=unused-import
from testutils import client, client_configfile
from .testutils import client, client_configfile
from kanidm import KanidmClient
logging.basicConfig(level=logging.DEBUG)
@ -21,7 +21,7 @@ async def test_radius_call(client_configfile: KanidmClient) -> None:
print("Doing auth_init using token")
if client_configfile.config.auth_token is None:
pytest.skip("You can't test auth if you don't have an auth_token in ~/.config/kanidm")
pytest.skip("You can't test auth if you don't have an auth_token in ~/.config/kanidm") # type: ignore[call-non-callable]
result = await client_configfile.get_radius_token(RADIUS_TEST_USER)
print(f"{result=}")

View file

@ -3,7 +3,7 @@
import pytest
import aiohttp.client_exceptions
from testutils import client
from .testutils import client
from kanidm import KanidmClient

View file

@ -187,7 +187,7 @@ async def test_ssl_untrusted_root_configured() -> None:
testcert = Path("./tests/badssl_trusted_ca.pem").resolve()
if not testcert.exists():
pytest.skip(f"The trusted cert is missing from {testcert}")
pytest.skip(f"The trusted cert is missing from {testcert}") # type: ignore[call-non-callable]
client = KanidmClient(
uri="https://untrusted-root.badssl.com/",

View file

@ -2,30 +2,30 @@
from logging import DEBUG, basicConfig, getLogger
from pathlib import Path
from typing import Any
from typing import Any, Optional
import pytest
from kanidm import KanidmClient
@pytest.fixture(scope="function")
async def client() -> KanidmClient:
async def client() -> Optional[KanidmClient]:
"""sets up a client with a basic thing"""
try:
basicConfig(level=DEBUG)
return KanidmClient(uri="https://idm.example.com")
except FileNotFoundError:
raise pytest.skip("Couldn't find config file...")
pytest.skip("Couldn't find config file...") # type: ignore[call-non-callable]
@pytest.fixture(scope="function")
async def client_configfile() -> KanidmClient:
async def client_configfile() -> Optional[KanidmClient]:
"""sets up a client from a config file"""
try:
return KanidmClient(config_file=Path("~/.config/kanidm"))
except FileNotFoundError:
raise pytest.skip("Couldn't find config file...")
pytest.skip("Couldn't find config file...") # type: ignore[call-non-callable]
class MockResponse:

2200
pykanidm/uv.lock Normal file

File diff suppressed because it is too large Load diff

View file

@ -0,0 +1 @@
3.12

3
rlm_python/README.md Normal file
View file

@ -0,0 +1,3 @@
# rlm_python
Kanidm FreeRADIUS module.

View file

@ -1,2 +1,13 @@
[tool.ruff]
line-length = 150
[project]
name = "rlm-python"
version = "0.1.0"
description = "FreeRADIUS Kanidm module"
readme = "README.md"
requires-python = ">=3.10"
dependencies = ["kanidm"]
[dependency-groups]
dev = ["mypy>=1.15.0", "pytest>=8.3.5", "ruff>=0.11.9", "ty>=0.0.0a8"]
[tool.uv.sources]
kanidm = { path = "../pykanidm" }

View file

@ -1,4 +1,4 @@
""" entrypoint for kanidm's RADIUS module """
"""entrypoint for kanidm's RADIUS module"""
import atexit
import os
@ -7,15 +7,16 @@ import subprocess
import shutil
import signal
import sys
from typing import Any
from typing import Any, Optional
# import toml
import kanidm.radius
from kanidm.radius import CONFIG_PATHS
from kanidm.types import KanidmClientConfig
from kanidm.utils import load_config
DEBUG = True
if os.environ.get('DEBUG', False):
if os.environ.get("DEBUG", False):
DEBUG = True
CERT_SERVER_DEST = "/etc/raddb/certs/server.pem"
@ -23,54 +24,62 @@ CERT_CA_DEST = "/etc/raddb/certs/ca.pem"
CERT_CA_DIR = "/etc/raddb/certs/"
CERT_DH_DEST = "/etc/raddb/certs/dh.pem"
# pylint: disable=unused-argument
def _sigchild_handler(
*args: Any,
**kwargs: Any,
) -> None:
""" handler for SIGCHLD call"""
) -> None:
"""handler for SIGCHLD call"""
print("Received SIGCHLD ...", file=sys.stderr)
os.waitpid(-1, os.WNOHANG)
def write_clients_conf(
kanidm_config_object: KanidmClientConfig,
) -> None:
""" writes out the config file """
) -> None:
"""writes out the config file"""
raddb_config_file = Path("/etc/raddb/clients.conf")
with raddb_config_file.open('w', encoding='utf-8') as file_handle:
with raddb_config_file.open("w", encoding="utf-8") as file_handle:
for client in kanidm_config_object.radius_clients:
file_handle.write(f"client {client.name} {{\n" )
file_handle.write(f"client {client.name} {{\n")
file_handle.write(f" ipaddr = {client.ipaddr}\n")
file_handle.write(f" secret = {client.secret}\n" )
file_handle.write(' proto = *\n')
file_handle.write('}\n')
file_handle.write(f" secret = {client.secret}\n")
file_handle.write(" proto = *\n")
file_handle.write("}\n")
def setup_certs(
kanidm_config_object: KanidmClientConfig,
) -> None:
""" sets up certificates """
) -> None:
"""sets up certificates"""
if kanidm_config_object.radius_ca_path:
cert_ca = Path(kanidm_config_object.radius_ca_path).expanduser().resolve()
if not cert_ca.exists():
print(f"Failed to find radiusd ca file ({cert_ca}), quitting!", file=sys.stderr)
print(
f"Failed to find radiusd ca file ({cert_ca}), quitting!",
file=sys.stderr,
)
sys.exit(1)
if cert_ca != CERT_CA_DEST:
if cert_ca != Path(CERT_CA_DEST):
print(f"Copying {cert_ca} to {CERT_CA_DEST}")
try:
shutil.copyfile(cert_ca, CERT_CA_DEST)
except shutil.SameFileError:
pass
# This dir can also contain crls!
if kanidm_config_object.radius_ca_dir:
cert_ca_dir = Path(kanidm_config_object.radius_ca_dir).expanduser().resolve()
if not cert_ca_dir.exists():
print(f"Failed to find radiusd ca dir ({cert_ca_dir}), quitting!", file=sys.stderr)
print(
f"Failed to find radiusd ca dir ({cert_ca_dir}), quitting!",
file=sys.stderr,
)
sys.exit(1)
if cert_ca_dir != CERT_CA_DIR:
if cert_ca_dir != Path(CERT_CA_DIR):
print(f"Copying {cert_ca_dir} to {CERT_CA_DIR}")
shutil.copytree(cert_ca_dir, CERT_CA_DIR, dirs_exist_ok=True)
@ -83,7 +92,7 @@ def setup_certs(
print(
f"Failed to find server keyfile ({server_key}), quitting!",
file=sys.stderr,
)
)
sys.exit(1)
server_cert = Path(kanidm_config_object.radius_cert_path).expanduser().resolve()
@ -91,18 +100,19 @@ def setup_certs(
print(
f"Failed to find server cert file ({server_cert}), quitting!",
file=sys.stderr,
)
)
sys.exit(1)
# concat key + cert into /etc/raddb/certs/server.pem
with open(CERT_SERVER_DEST, 'w', encoding='utf-8') as file_handle:
with open(CERT_SERVER_DEST, "w", encoding="utf-8") as file_handle:
file_handle.write(server_cert.read_text(encoding="utf-8"))
file_handle.write('\n')
file_handle.write("\n")
file_handle.write(server_key.read_text(encoding="utf-8"))
def kill_radius(
proc: subprocess.Popen,
) -> None:
""" handler to kill the radius server once the script exits """
proc: subprocess.Popen[Any],
) -> None:
"""handler to kill the radius server once the script exits"""
if proc is None:
pass
else:
@ -116,8 +126,9 @@ def kill_radius(
proc.wait()
def find_freeradius_bin() -> str:
""" finds the binary """
def find_freeradius_bin() -> Optional[str]:
"""finds the binary"""
binary_paths = [
"/usr/sbin/radiusd",
"/usr/sbin/freeradius",
@ -129,37 +140,44 @@ def find_freeradius_bin() -> str:
print(f"Failed to find FreeRADIUS binary, looked in {lookedin}")
sys.exit(1)
def run_radiusd() -> None:
""" run the server """
"""run the server"""
if DEBUG:
cmd_args = [ "-X" ]
cmd_args = ["-X"]
else:
cmd_args = [ "-f", "-l", "stdout" ]
with subprocess.Popen(
[find_freeradius_bin()] + cmd_args,
stderr=subprocess.STDOUT,
cmd_args = ["-f", "-l", "stdout"]
freeradius_bin = find_freeradius_bin()
if freeradius_bin is None:
print("Failed to find FreeRADIUS binary, quitting!", file=sys.stderr)
sys.exit(1)
else:
with subprocess.Popen(
[freeradius_bin] + cmd_args,
stderr=subprocess.STDOUT,
) as proc:
# print(proc, file=sys.stderr)
atexit.register(kill_radius, proc)
proc.wait()
# print(proc, file=sys.stderr)
atexit.register(kill_radius, proc)
proc.wait()
if __name__ == '__main__':
if __name__ == "__main__":
signal.signal(signal.SIGCHLD, _sigchild_handler)
config_file = kanidm.radius.find_radius_config_path()
if config_file is None:
print(
"Failed to find configuration file ({config_file}), quitting!",
f"Failed to find configuration file in ({CONFIG_PATHS}), quitting!",
file=sys.stderr,
)
)
sys.exit(1)
kanidm_config = KanidmClientConfig.model_validate(load_config(config_file))
setup_certs(kanidm_config)
write_clients_conf(kanidm_config)
print("Configuration set up, starting...")
try:
run_radiusd()
except KeyboardInterrupt as ki:
print(ki)
else:
kanidm_config = KanidmClientConfig.model_validate(load_config(config_file))
setup_certs(kanidm_config)
write_clients_conf(kanidm_config)
print("Configuration set up, starting...")
try:
run_radiusd()
except KeyboardInterrupt as ki:
print(ki)

1046
rlm_python/uv.lock Normal file

File diff suppressed because it is too large Load diff

View file

@ -10,9 +10,9 @@ if [ ! -d ".venv" ]; then
# shellcheck disable=SC1091
source .venv/bin/activate
pip install --upgrade pip
pip install poetry pytest ruff mypy black
pip install uv
echo "Installing in virtualenv"
pip install -e pykanidm
pip install -e .
fi
# shellcheck disable=SC1091

View file

@ -106,4 +106,4 @@ HEALTHCHECK \
--retries=3 \
CMD [ "/sbin/kanidmd", "healthcheck", "-c", "/data/server.toml"]
CMD [ "/sbin/kanidmd", "server", "-c", "/data/server.toml"]
CMD [ "/sbin/kanidmd", "server"]

View file

@ -72,7 +72,7 @@ priority = "optional"
changelog = "../../target/debian/changelog" # Generated by platform/debian/build_debs.sh
assets = [
[ "target/release/kanidmd", "usr/bin/", "755" ],
[ "debian/group.conf", "usr/lib/sysusers.d/kandimd.conf", "644" ],
[ "debian/group.conf", "usr/lib/sysusers.d/kanidmd.conf", "644" ],
[ "debian/server.toml", "etc/kanidmd/server.toml", "640" ],
[ "../../examples/server.toml", "usr/share/kanidmd/", "444" ],
[ "../core/static/**/*", "usr/share/kanidmd/static", "444" ],

View file

@ -257,7 +257,7 @@ mod tests {
/// this is a test case for bad characters in SSH keys
fn test_invalid_character() {
let ecdsa = concat!("ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEÀAAAIbmlzdHA1MjEAAACFBAGyIY7o3B",
// ^ note the À here
// ^ note the À here
"tOzRiJ9vvjj96bRImwmyy5GvFSIUPlK00HitiAWGhiO1jGZKmK7220Oe4rqU3uAwA00a0758UODs+0OQHLMDRtl81l",
"zPrVSdrYEDldxH9+a86dBZhdm0è15+ODDts2LHUknsJCRRldO4o9R9VrohlF7cbyBlnhJQrR4S+Oag== william@a",
"methyst");
@ -278,4 +278,37 @@ mod tests {
); // the offset is 31 because the string has a 20 character leading key type plus the space
}
}
#[test]
/// this is a test case for bad characters in SSH keys
fn test_assert_comments() {
// Comment is okay.
let ecdsa = concat!("ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAGyIY7o3B",
"tOzRiJ9vvjj96bRImwmyy5GvFSIUPlK00HitiAWGhiO1jGZKmK7220Oe4rqU3uAwA00a0758UODs+0OQHLMDRtl81l",
"zPrVSdrYEDldxH9+a86dBZhdm0e15+ODDts2LHUknsJCRRldO4o9R9VrohlF7cbyBlnhJQrR4S+Oag== william@a",
"methyst");
let _ = SshPublicKey::from_string(ecdsa).unwrap();
// No comment is okay.
let ecdsa = concat!("ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAGyIY7o3B",
"tOzRiJ9vvjj96bRImwmyy5GvFSIUPlK00HitiAWGhiO1jGZKmK7220Oe4rqU3uAwA00a0758UODs+0OQHLMDRtl81l",
"zPrVSdrYEDldxH9+a86dBZhdm0e15+ODDts2LHUknsJCRRldO4o9R9VrohlF7cbyBlnhJQrR4S+Oag==");
let _ = SshPublicKey::from_string(ecdsa).unwrap();
// No comment is okay (spaces to end of line)
let ecdsa = concat!("ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAGyIY7o3B",
"tOzRiJ9vvjj96bRImwmyy5GvFSIUPlK00HitiAWGhiO1jGZKmK7220Oe4rqU3uAwA00a0758UODs+0OQHLMDRtl81l",
"zPrVSdrYEDldxH9+a86dBZhdm0e15+ODDts2LHUknsJCRRldO4o9R9VrohlF7cbyBlnhJQrR4S+Oag== ");
let _ = SshPublicKey::from_string(ecdsa).unwrap();
// Comment may have spaces
let ecdsa = concat!("ecdsa-sha2-nistp521 AAAAE2VjZHNhLXNoYTItbmlzdHA1MjEAAAAIbmlzdHA1MjEAAACFBAGyIY7o3B",
"tOzRiJ9vvjj96bRImwmyy5GvFSIUPlK00HitiAWGhiO1jGZKmK7220Oe4rqU3uAwA00a0758UODs+0OQHLMDRtl81l",
"zPrVSdrYEDldxH9+a86dBZhdm0e15+ODDts2LHUknsJCRRldO4o9R9VrohlF7cbyBlnhJQrR4S+Oag== I'm a giraffe! ");
let _ = SshPublicKey::from_string(ecdsa).unwrap();
}
}