Source code for gssapi.raw.sec_contexts

import typing as t

if t.TYPE_CHECKING:
    from gssapi.raw.chan_bindings import ChannelBindings
    from gssapi.raw.creds import Creds
    from gssapi.raw.named_tuples import (
        AcceptSecContextResult,
        InitSecContextResult,
        InquireContextResult,
    )
    from gssapi.raw.names import Name
    from gssapi.raw.oids import OID
    from gssapi.raw.types import RequirementFlag

[docs]class SecurityContext: """ A GSSAPI Security Context """ def __new__( cls, cpy: t.Optional["SecurityContext"] = None, ) -> "SecurityContext": ... @property def _started(self) -> bool: ...
[docs]def init_sec_context( name: "Name", creds: t.Optional["Creds"] = None, context: t.Optional[SecurityContext] = None, mech: t.Optional["OID"] = None, flags: t.Optional[t.Union[ int, "RequirementFlag", t.Iterable[int], t.Iterable["RequirementFlag"] ]] = None, lifetime: t.Optional[int] = None, channel_bindings: t.Optional["ChannelBindings"] = None, input_token: t.Optional[bytes] = None, ) -> "InitSecContextResult": """Initiate a GSSAPI security context. This method initiates a GSSAPI security context, targeting the given target name. To create a basic context, just provide the target name. Further calls used to update the context should pass in the output context of the last call, as well as the input token received from the acceptor. Warning: This changes the input context! Args: target_name (~gssapi.raw.names.Name): the target for the security context creds (Creds): the credentials to use to initiate the context, or None to use the default credentials context (~gssapi.raw.sec_contexts.SecurityContext): the security context to update, or None to create a new context mech (~gssapi.raw.types.MechType): the mechanism type for this security context, or None for the default mechanism type flags (list): the flags to request for the security context, or None to use the default set: mutual_authentication and out_of_sequence_detection. This may also be an :class:`IntEnumFlagSet` lifetime (int): the request lifetime of the security context in seconds (a value of 0 or None means indefinite) channel_bindings (ChannelBindings): The channel bindings (or None for no channel bindings) input_token (bytes): the token to use to update the security context, or None if you are creating a new context Returns: InitSecContextResult: the output security context, the actual mech type, the actual flags used, the output token to send to the acceptor, the actual lifetime of the context in seconds (or None if not supported or indefinite), and whether or not more calls are needed to finish the initiation. Raises: ~gssapi.exceptions.InvalidTokenError ~gssapi.exceptions.InvalidCredentialsError ~gssapi.exceptions.MissingCredentialsError ~gssapi.exceptions.ExpiredCredentialsError ~gssapi.exceptions.BadChannelBindingsError ~gssapi.exceptions.BadMICError ~gssapi.exceptions.ExpiredTokenError ~gssapi.exceptions.DuplicateTokenError ~gssapi.exceptions.MissingContextError ~gssapi.exceptions.BadNameTypeError ~gssapi.exceptions.BadNameError ~gssapi.exceptions.BadMechanismError """
[docs]def accept_sec_context( input_token: bytes, acceptor_creds: t.Optional["Creds"] = None, context: t.Optional[SecurityContext] = None, channel_bindings: t.Optional["ChannelBindings"] = None, ) -> "AcceptSecContextResult": """Accept a GSSAPI security context. This method accepts a GSSAPI security context using a token sent by the initiator, using the given credentials. It can either be used to accept a security context and create a new security context object, or to update an existing security context object. Warning: This changes the input context! Args: input_token (bytes): the token sent by the context initiator acceptor_creds (Creds): the credentials to be used to accept the context (or None to use the default credentials) context (~gssapi.raw.sec_contexts.SecurityContext): the security context to update (or None to create a new security context object) channel_bindings (ChannelBindings): The channel bindings (or None for no channel bindings) Returns: AcceptSecContextResult: the resulting security context, the initiator name, the mechanism being used, the output token, the flags in use, the lifetime of the context in seconds (or None for indefinite or not supported), the delegated credentials (valid only if the delegate_to_peer flag is set), and whether or not further token exchanges are needed to finalize the security context. Raises: ~gssapi.exceptions.InvalidTokenError ~gssapi.exceptions.InvalidCredentialsError ~gssapi.exceptions.MissingCredentialsError ~gssapi.exceptions.ExpiredCredentialsError ~gssapi.exceptions.BadChannelBindingsError ~gssapi.exceptions.MissingContextError ~gssapi.exceptions.BadMICError ~gssapi.exceptions.ExpiredTokenError ~gssapi.exceptions.DuplicateTokenError ~gssapi.exceptions.BadMechanismError """
[docs]def inquire_context( context: SecurityContext, initiator_name: bool = True, target_name: bool = True, lifetime: bool = True, mech: bool = True, flags: bool = True, locally_init: bool = True, complete: bool = True, ) -> "InquireContextResult": """Get information about a security context. This method obtains information about a security context, including the initiator and target names, as well as the TTL, mech, flags, and its current state (open vs closed). Note: the target name may be ``None`` if it would have been ``GSS_C_NO_NAME`` Args: context (~gssapi.raw.sec_contexts.SecurityContext): the context in question Returns: InquireContextResult: the initiator name, the target name, the TTL (can be None for indefinite or not supported), the mech type, the flags, whether or not the context was locally initiated, and whether or not the context is currently fully established Raises: ~gssapi.exceptions.MissingContextError """
[docs]def context_time( context: SecurityContext, ) -> int: """Get the amount of time for which the given context will remain valid. This method determines the amount of time for which the given security context will remain valid. An expired context will give a result of 0. Args: context (~gssapi.raw.sec_contexts.SecurityContext): the security context in question Returns: int: the number of seconds for which the context will be valid Raises: ~gssapi.exceptions.ExpiredContextError ~gssapi.exceptions.MissingContextError """
[docs]def process_context_token( context: SecurityContext, token: bytes, ) -> None: """Process a token asynchronously. This method provides a way to process a token, even if the given security context is not expecting one. For example, if the initiator has the initSecContext return that the context is complete, but the acceptor is unable to accept the context, and wishes to send a token to the initiator, letting the initiator know of the error. Warning: This method has been essentially deprecated by :rfc:`2744`. Args: context (~gssapi.raw.sec_contexts.SecurityContext): the security context against which to process the token token (bytes): the token to process Raises: ~gssapi.exceptions.InvalidTokenError ~gssapi.exceptions.MissingContextError """
[docs]def import_sec_context( token: bytes, ) -> SecurityContext: """Import a context from another process. This method imports a security context established in another process by reading the specified token which was output by :func:`export_sec_context`. Raises: ~gssapi.exceptions.MissingContextError ~gssapi.exceptions.InvalidTokenError ~gssapi.exceptions.OperationUnavailableError ~gssapi.exceptions.UnauthorizedError """
[docs]def export_sec_context( context: SecurityContext, ) -> bytes: """Export a context for use in another process. This method exports a security context, deactivating in the current process and creating a token which can then be imported into another process with :func:`import_sec_context`. Warning: this modifies the input context Args: context (~gssapi.raw.sec_contexts.SecurityContext): the context to send to another process Returns: bytes: the output token to be imported Raises: ~gssapi.exceptions.ExpiredContextError ~gssapi.exceptions.MissingContextError ~gssapi.exceptions.OperationUnavailableError """
[docs]def delete_sec_context( context: SecurityContext, local_only: bool = True, ) -> bytes: """Delete a GSSAPI security context. This method deletes a GSSAPI security context, returning an output token to send to the other holder of the security context to notify them of the deletion. Note: This method generally should not be used. :class:`SecurityContext` objects will automatically be freed by Python. Args: context (~gssapi.raw.sec_contexts.SecurityContext): the security context in question local_only (bool): should we request local deletion (True), or also remote deletion (False), in which case a token is also returned Returns: bytes: the output token (if remote deletion is requested). Generally this is None, but bytes for compatibility. Raises: ~gssapi.exceptions.MissingContextError """