File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/__pycache__/pam.cpython-310.pyc
o
�N�g� � @ s� d Z ddlZddlZddlZddlZddlZddlmZmZm Z m
Z
m Z m Z m
Z
mZmZmZmZmZ ddlmZ dZzddlZW n eyK dZY nw e�e�Zz eed��Z e j Z ee _ eege _ e j!Z"e ge"_#e e �e"_ W n e$y� ej%ddd � dZ&Y nw dZ&d
Z'd Z(d Z)d
Z*G dd� de
�Z+G dd� de
�Z,G dd� de
�Z-ee
e
e e e,��e e e-��e�Z.G dd� de
�Z/z:eed��Z0e0j1Z2e
e2_ e e e e/�e e+�ge2_ e0j3Z4e
e4_ e+e
ge4_ e0j5Z6e
e6_ e+e
ge6_ e0j7Z8e
e8_ e+e
ge8_ W n e$�y
ej%ddd � dZ9Y nw dZ9dd� Z:d(dd �Z;d d � Z<d d � Z=d!d"� Z>ed#k�rGe;ej?d$ ej?d% ej?d& ej?d' ��r@e�@d� e�@d
� dS dS ))a`
Authenticate against PAM
Provides an authenticate function that will allow the caller to authenticate
a user against the Pluggable Authentication Modules (PAM) on the system.
Implemented using ctypes, so no compilation is necessary.
There is one extra configuration option for pam. The `pam_service` that is
authenticated against. This defaults to `login`
.. code-block:: yaml
auth.pam.service: login
.. note:: Solaris-like (SmartOS, OmniOS, ...) systems may need ``auth.pam.service`` set to ``other``.
.. note:: PAM authentication will not work for the ``root`` user.
The Python interface to PAM does not support authenticating as ``root``.
.. note:: This module executes itself in a subprocess in order to user the system python
and pam libraries. We do this to avoid openssl version conflicts when
running under a salt onedir build.
� N) �CDLL� CFUNCTYPE�POINTER� Structure�c_char�c_char_p�c_int�c_uint�c_void_p�cast�pointer�sizeof)� find_libraryTF�cz Failed to load libc using ctypes)�exc_info� � � � c @ s" e Zd ZdZdefgZdd� ZdS )� PamHandlez(
Wrapper class for pam_handle_t
�handlec C s t �| � d| _d S )Nr )r �__init__r ��self� r �A/opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/pam.pyr [ s
zPamHandle.__init__N)�__name__�
__module__� __qualname__�__doc__r
�_fields_r r r r r r T s
r c @ �( e Zd ZdZdefdefgZdd� ZdS )�
PamMessagez1
Wrapper class for pam_message structure
� msg_style�msgc C � d| j � d| j� d�S )Nz <PamMessage � '�'>)r# r$ r r r r �__repr__j � zPamMessage.__repr__N)r r r r r r r r( r r r r r" ` � � r" c @ r! )� PamResponsez2
Wrapper class for pam_response structure
�resp� resp_retcodec C r% )Nz
<PamResponse r& r' )r- r, r r r r r( x r) zPamResponse.__repr__N)r r r r r r r r( r r r r r+ n r* r+ c @ s e Zd ZdZdefdefgZdS )�PamConvz.
Wrapper class for pam_conv structure
�convZ appdata_ptrN)r r r r � CONV_FUNCr
r r r r r r. � s r. Zpamz Failed to load pam using ctypesc C s t otS )z$
Only load on Linux systems
)�HAS_LIBC�HAS_PAMr r r r � __virtual__� s r3 �utf-8c s� t | t�r
| �|�} t � t�r� �|�� t |t�r |�|�}t� fdd��}t� }t|d�}t|| t|�t|��}|dkrDt||� dS t |d�}|dkrRt
|d�}t|d� |dkS )��
Returns True if the given username and password authenticate for the
given service. Returns False otherwise
``username``: the username to authenticate
``password``: the password in plain text
c sh t | tt��}t|tt��|d< t| �D ] }|| jjtkr1t � �}t|t
�|j| _ d|j| _ qdS )z�
Simple conversation function that responds to any
prompt where the echo is off with the supplied password
r )
�CALLOCr
r+ r r �range�contentsr# �PAM_PROMPT_ECHO_OFF�STRDUPr r, r- )Z
n_messages�messagesZ
p_responseZapp_data�addr�iZpw_copy��passwordr r �my_conv� s �z _authenticate.<locals>.my_convr F) �
isinstance�str�encoder0 r r. � PAM_STARTr �PAM_END�PAM_AUTHENTICATE�
PAM_ACCT_MGMT)�usernamer? Zservice�encodingr@ r r/ �retvalr r> r �
_authenticate� s&
rK c C s� t j�� }| |d< ||d< t�dd�|d< t|d< t�t�dd���� }t�t ��� }|�
� s7t � d |� d
S t
jt|�t|�g|d d
d �}|jd
krMd S t � d| |j|j� d
S )r5 �SALT_PAM_USERNAME�SALT_PAM_PASSWORDzauth.pam.serviceZlogin�SALT_PAM_SERVICE�SALT_PAM_ENCODINGzauth.pam.pythonz/usr/bin/python3z7Error 'auth.pam.python' config value does not exist: %sFT)�env�capture_output�checkr z Pam auth failed for %s: %s %s)�os�environ�copyZ__opts__�getZ__salt_system_encoding__�pathlib�Path�resolve�__file__�exists�log�error�
subprocess�runrB �
returncode�stdout�stderr)rH r? rP ZpyexeZpyfile�retr r r � authenticate� s(
�
rd c K s
t | |�S )z
Authenticate via pam
)rd )rH r? �kwargsr r r �auth� s
rf c O s t jj�| �S )zY
Retrieve groups for a given user for this auth provider
Uses system groups
)�salt�utils�userZget_group_list)rH �argsre r r r �groups� s rk �__main__rL rM rN rO )r4 )Ar �loggingrS rW r^ �sys�ctypesr r r r r r r r r
r r r
Z ctypes.utilr ZHAS_USERZsalt.utils.userrg � ImportError� getLoggerr r\ ZLIBCZcallocr6 �restype�argtypesZstrdupr: Z argstypes� ExceptionZtracer1 r9 ZPAM_PROMPT_ECHO_ONZ
PAM_ERROR_MSGZ
PAM_TEXT_INFOr r" r+ r0 r. ZLIBPAMZ pam_startrD Zpam_authenticaterF Z
pam_acct_mgmtrG Zpam_endrE r2 r3 rK rd rf rk rT �exitr r r r �<module> s� 8 �
� �
�
1
�
�