o

�N�g|�@s�dZd
dl
Z
d
dlZz6z
d
dlmZ
dZWn'ey<


dZzd
dlm	Z	
Wney5


d
dl
m	Z	
Yn
wd
dlZYn
wdZWneyK


dZYn
we
�
e�
Zdd�Zd	d
�ZdS)az

Authenticate via a PKI certificate.

.. note::

    This module is Experimental and should be used with caution

Provides an authenticate function that will allow the caller to authenticate
a user via their public cert against a pre-defined Certificate Authority.

TODO: Add a 'ca_dir' option to configure a directory of CA files, a la Apache.

:depends:    - pyOpenSSL module
�N)
�X509TF)
�asn1c
Cstrd
SdS)z/
    Requires newer pycrypto and pyOpenSSL
    TF)
�HAS_DEPS�rr�A/opt/saltstack/salt/lib/python3.10/site-packages/salt/auth/pki.py�__virtual__+s

rc	Ks�
|
}td
d�
}t
�d�

t
�d|�
t
�d|�
tr@t�|tj�}t�|tj�}|�|�	��
r8t
�
d|�
dSt
�
d|�
d	Stj}|�
|j|�}tjj�|�
�}|�
|j|���}Wd
�
n1sew



Y
|��}	|�|j|�}
t��}|�|
�

|d}|d}
t��}|�|
�

|j}|dd
kr�td�
�
|dd
�}z!|�||||	�
t|�����
d|ks�Jd�
�
t
�
d|�
WdStjj t!fy�


t
�
d|�
Yd	Sw)a�
    Returns True if the given user cert (password is the cert contents)
    was issued by the CA and if cert's Common Name is equal to username.

    Returns False otherwise.

    ``username``: we need it to run the auth function from CLI/API;
                  it should be in master config auth/acl
    ``password``: contents of user certificate (pem-encoded user public key);
                  why "password"? For CLI, it's the only available name

    Configure the CA cert in the master config file:

    .. code-block:: yaml

        external_auth:
          pki:
            ca_file: /etc/pki/tls/ca_certs/trusted-ca.crt
            your_user:
              - .*
    z
config.getzexternal_auth:pki:ca_filez#Attempting to authenticate via pki.zUsing CA file: %szCertificate contents: %sz*Successfully authenticated certificate: %sTz&Failed to authenticate certificate: %sFNr
��
z Number of unused bits is strange�
ZCNz*Certificate's CN should match the username)"Z__salt__�log�debug�HAS_M2rZload_cert_stringZ
FORMAT_PEMZ	load_certZverifyZ
get_pubkey�info�OpenSSLZcryptoZload_certificateZFILETYPE_PEM�salt�utils�filesZfopen�readZget_signature_algorithmZdump_certificateZ
FILETYPE_ASN1rZDerSequence�decodeZ	DerObject�payload�	Exception�dictZget_subjectZget_components�Error�AssertionError)�username�password�kwargsZpemZcacert_file�certZcacert�
c�
fZalgoZ	cert_asn1ZderZder_certZder_sigZ
der_sig_inZsig0�sigrrr�auth4sR












�






�



�r!)�__doc__�loggingZsalt.utils.filesrZM2Cryptorr
�ImportErrorZCryptodome.UtilrZCrypto.Utilrr�	getLogger�__name__rrr!rrrr�<module>
s.







��

�