| 1 | |
|---|
| 2 | <!doctype html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> |
|---|
| 3 | <html><head><title>Python: module infocardlib</title> |
|---|
| 4 | </head><body bgcolor="#f0f0f8"> |
|---|
| 5 | |
|---|
| 6 | <table width="100%" cellspacing=0 cellpadding=2 border=0 summary="heading"> |
|---|
| 7 | <tr bgcolor="#7799ee"> |
|---|
| 8 | <td valign=bottom> <br> |
|---|
| 9 | <font color="#ffffff" face="helvetica, arial"> <br><big><big><strong>infocardlib</strong></big></big></font></td |
|---|
| 10 | ><td align=right valign=bottom |
|---|
| 11 | ><font color="#ffffff" face="helvetica, arial"><a href=".">index</a><br><a href="file:/home/dbuss/dev/bandit/rp/common/python/infocard/infocardlib.py">/home/dbuss/dev/bandit/rp/common/python/infocard/infocardlib.py</a></font></td></tr></table> |
|---|
| 12 | <p><tt># Copyright (c) 2007, 2008 Novell, Inc.<br> |
|---|
| 13 | # All Rights Reserved.</tt></p> |
|---|
| 14 | <p> |
|---|
| 15 | <table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section"> |
|---|
| 16 | <tr bgcolor="#aa55cc"> |
|---|
| 17 | <td colspan=3 valign=bottom> <br> |
|---|
| 18 | <font color="#fffff" face="helvetica, arial"><big><strong>Modules</strong></big></font></td></tr> |
|---|
| 19 | |
|---|
| 20 | <tr><td bgcolor="#aa55cc"><tt> </tt></td><td> </td> |
|---|
| 21 | <td width="100%"><table width="100%" summary="list"><tr><td width="25%" valign=top><a href="cookielib.html">cookielib</a><br> |
|---|
| 22 | <a href="datetime.html">datetime</a><br> |
|---|
| 23 | <a href="event.html">event</a><br> |
|---|
| 24 | </td><td width="25%" valign=top><a href="hashlib.html">hashlib</a><br> |
|---|
| 25 | <a href="xml.dom.minidom.html">xml.dom.minidom</a><br> |
|---|
| 26 | <a href="re.html">re</a><br> |
|---|
| 27 | </td><td width="25%" valign=top><a href="sys.html">sys</a><br> |
|---|
| 28 | <a href="traceback.html">traceback</a><br> |
|---|
| 29 | <a href="urlparse.html">urlparse</a><br> |
|---|
| 30 | </td><td width="25%" valign=top><a href="_xmlplus.html">_xmlplus</a><br> |
|---|
| 31 | <a href="xmlseclibs.html">xmlseclibs</a><br> |
|---|
| 32 | <a href="xml.xpath.html">xml.xpath</a><br> |
|---|
| 33 | </td></tr></table></td></tr></table><p> |
|---|
| 34 | <table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section"> |
|---|
| 35 | <tr bgcolor="#ee77aa"> |
|---|
| 36 | <td colspan=3 valign=bottom> <br> |
|---|
| 37 | <font color="#ffffff" face="helvetica, arial"><big><strong>Classes</strong></big></font></td></tr> |
|---|
| 38 | |
|---|
| 39 | <tr><td bgcolor="#ee77aa"><tt> </tt></td><td> </td> |
|---|
| 40 | <td width="100%"><dl> |
|---|
| 41 | <dt><font face="helvetica, arial"><a href="infocardlib.html#InfoCardProcessor">InfoCardProcessor</a> |
|---|
| 42 | </font></dt><dt><font face="helvetica, arial"><a href="infocardlib.html#SecToken">SecToken</a> |
|---|
| 43 | </font></dt></dl> |
|---|
| 44 | <p> |
|---|
| 45 | <table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section"> |
|---|
| 46 | <tr bgcolor="#ffc8d8"> |
|---|
| 47 | <td colspan=3 valign=bottom> <br> |
|---|
| 48 | <font color="#000000" face="helvetica, arial"><a name="InfoCardProcessor">class <strong>InfoCardProcessor</strong></a></font></td></tr> |
|---|
| 49 | |
|---|
| 50 | <tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td> |
|---|
| 51 | <td colspan=2><tt>Base object for consumers who wish to build a python based RP for <br> |
|---|
| 52 | processing information cards and dealing with cardspace.<br> |
|---|
| 53 | <br> |
|---|
| 54 | This object may be created and configured once then used to evaluate many <br> |
|---|
| 55 | security tokens<br> </tt></td></tr> |
|---|
| 56 | <tr><td> </td> |
|---|
| 57 | <td width="100%">Methods defined here:<br> |
|---|
| 58 | <dl><dt><a name="InfoCardProcessor-__init__"><strong>__init__</strong></a>(self)</dt></dl> |
|---|
| 59 | |
|---|
| 60 | <dl><dt><a name="InfoCardProcessor-processToken"><strong>processToken</strong></a>(self, xmlToken<font color="#909090">=None</font>)</dt><dd><tt>Parse the token using prevously configured keys, claims and options.<br> |
|---|
| 61 | <br> |
|---|
| 62 | returns a <a href="#SecToken">SecToken</a> objec, the returned secToken may or may not be valid,<br> |
|---|
| 63 | it is up to the caller to check secToken.isValid()</tt></dd></dl> |
|---|
| 64 | |
|---|
| 65 | <dl><dt><a name="InfoCardProcessor-setClaims"><strong>setClaims</strong></a>(self, required, optional<font color="#909090">=None</font>, multivalued<font color="#909090">=None</font>)</dt><dd><tt>Helper function to simplify setting of the optional and required<br> |
|---|
| 66 | claims, as well as which claims may be multivalued.<br> |
|---|
| 67 | <br> |
|---|
| 68 | Failure to tell the processor which claims are expected may result in<br> |
|---|
| 69 | errors being reported. The process helps verify that all required claims<br> |
|---|
| 70 | were received and that no additional claims were sent.<br> |
|---|
| 71 | <br> |
|---|
| 72 | Todo: insert empty claim handling<br> |
|---|
| 73 | Todo: insert custom claim transformations<br> |
|---|
| 74 | <br> |
|---|
| 75 | always returns None</tt></dd></dl> |
|---|
| 76 | |
|---|
| 77 | <dl><dt><a name="InfoCardProcessor-setDecode"><strong>setDecode</strong></a>(self, privateKey, passPhrase<font color="#909090">=None</font>, isFile<font color="#909090">=False</font>, isCert<font color="#909090">=True</font>)</dt><dd><tt>Setup the cert/private key used to decrypt tokens. In many cases this <br> |
|---|
| 78 | will be the servers ssl cert.<br> |
|---|
| 79 | <br> |
|---|
| 80 | always returns None</tt></dd></dl> |
|---|
| 81 | |
|---|
| 82 | <dl><dt><a name="InfoCardProcessor-setOptions"><strong>setOptions</strong></a>(self, options)</dt><dd><tt>Set options for processing the security token<br> |
|---|
| 83 | <br> |
|---|
| 84 | The most common options relate to the overriding of event severity, please<br> |
|---|
| 85 | see evemt.py for details of option name and values.</tt></dd></dl> |
|---|
| 86 | |
|---|
| 87 | </td></tr></table> <p> |
|---|
| 88 | <table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section"> |
|---|
| 89 | <tr bgcolor="#ffc8d8"> |
|---|
| 90 | <td colspan=3 valign=bottom> <br> |
|---|
| 91 | <font color="#000000" face="helvetica, arial"><a name="SecToken">class <strong>SecToken</strong></a></font></td></tr> |
|---|
| 92 | |
|---|
| 93 | <tr bgcolor="#ffc8d8"><td rowspan=2><tt> </tt></td> |
|---|
| 94 | <td colspan=2><tt>Class for the parsing and holding of security token data<br> |
|---|
| 95 | <br> |
|---|
| 96 | Instantiate, configure, process, check validity<br> |
|---|
| 97 | Typiclly not directly instanciated, instead <a href="#InfoCardProcessor">InfoCardProcessor</a> is used to <br> |
|---|
| 98 | hold the common configuration and as a factory for creating SecTokens<br> |
|---|
| 99 | <br> |
|---|
| 100 | Todo: currently only supports SAML 1.0/1.1 tokens, that should be abstracted out<br> |
|---|
| 101 | to allow for many token types.<br> </tt></td></tr> |
|---|
| 102 | <tr><td> </td> |
|---|
| 103 | <td width="100%">Methods defined here:<br> |
|---|
| 104 | <dl><dt><a name="SecToken-__init__"><strong>__init__</strong></a>(self, options<font color="#909090">=None</font>)</dt></dl> |
|---|
| 105 | |
|---|
| 106 | <dl><dt><a name="SecToken-getAssertionValues"><strong>getAssertionValues</strong></a>(self, identifier<font color="#909090">=None</font>)</dt><dd><tt>Allows retrivial of any claim or assertion associated with the security token<br> |
|---|
| 107 | <br> |
|---|
| 108 | Todo:: visit and finish this function<br> |
|---|
| 109 | Returns either the data or None</tt></dd></dl> |
|---|
| 110 | |
|---|
| 111 | <dl><dt><a name="SecToken-getMetaDataValues"><strong>getMetaDataValues</strong></a>(self, identifier<font color="#909090">=None</font>)</dt><dd><tt>Allows retrivial of any meta data associated with the security token<br> |
|---|
| 112 | <br> |
|---|
| 113 | Note: currently all meta data is single valued!<br> |
|---|
| 114 | Pass a specific string for the identifier and receive either a <br> |
|---|
| 115 | string or None<br> |
|---|
| 116 | If the identifier is None then a dictionary of all meta data is returned</tt></dd></dl> |
|---|
| 117 | |
|---|
| 118 | <dl><dt><a name="SecToken-processToken"><strong>processToken</strong></a>(self, xmlToken, options)</dt><dd><tt>Process the token, until processed no data is present<br> |
|---|
| 119 | <br> |
|---|
| 120 | returns True if valid, False if invalid. Events are logged to <br> |
|---|
| 121 | self.<strong>eventLog</strong> detialing failure reasons.</tt></dd></dl> |
|---|
| 122 | |
|---|
| 123 | </td></tr></table></td></tr></table><p> |
|---|
| 124 | <table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section"> |
|---|
| 125 | <tr bgcolor="#eeaa77"> |
|---|
| 126 | <td colspan=3 valign=bottom> <br> |
|---|
| 127 | <font color="#ffffff" face="helvetica, arial"><big><strong>Functions</strong></big></font></td></tr> |
|---|
| 128 | |
|---|
| 129 | <tr><td bgcolor="#eeaa77"><tt> </tt></td><td> </td> |
|---|
| 130 | <td width="100%"><dl><dt><a name="-checkDateConditions"><strong>checkDateConditions</strong></a>(start<font color="#909090">=None</font>, end<font color="#909090">=None</font>, difference<font color="#909090">=300</font>)</dt><dd><tt>Validate a datetime is in range. <br> |
|---|
| 131 | <br> |
|---|
| 132 | difference in seconds allows for clock skew.<br> |
|---|
| 133 | <br> |
|---|
| 134 | Todo:: need work on ISO date checking - skip for now<br> |
|---|
| 135 | <br> |
|---|
| 136 | returns True if time is in range False if not in range</tt></dd></dl> |
|---|
| 137 | </td></tr></table><p> |
|---|
| 138 | <table width="100%" cellspacing=0 cellpadding=2 border=0 summary="section"> |
|---|
| 139 | <tr bgcolor="#55aa55"> |
|---|
| 140 | <td colspan=3 valign=bottom> <br> |
|---|
| 141 | <font color="#ffffff" face="helvetica, arial"><big><strong>Data</strong></big></font></td></tr> |
|---|
| 142 | |
|---|
| 143 | <tr><td bgcolor="#55aa55"><tt> </tt></td><td> </td> |
|---|
| 144 | <td width="100%"><strong>BEARER_TOKEN</strong> = 'urn:oasis:names:tc:SAML:1.0:cm:bearer'<br> |
|---|
| 145 | <strong>HOLDER_OF_KEY_TOKEN</strong> = 'urn:oasis:names:tc:SAML:1.0:cm:holder-of-key'<br> |
|---|
| 146 | <strong>META_AssertionID</strong> = 'AssertionID'<br> |
|---|
| 147 | <strong>META_Audience</strong> = 'Audience'<br> |
|---|
| 148 | <strong>META_CardKeyHash</strong> = 'CardKeyHash'<br> |
|---|
| 149 | <strong>META_IssueInstant</strong> = 'IssueInstant'<br> |
|---|
| 150 | <strong>META_Issuer</strong> = 'Issuer'<br> |
|---|
| 151 | <strong>META_MajorVersion</strong> = 'MajorVersion'<br> |
|---|
| 152 | <strong>META_MinorVersion</strong> = 'MinorVersion'<br> |
|---|
| 153 | <strong>META_NotBefore</strong> = 'NotBefore'<br> |
|---|
| 154 | <strong>META_NotOnOrAfter</strong> = 'NotOnOrAfter'<br> |
|---|
| 155 | <strong>META_SubjectConfirmation</strong> = 'SubjectConfirmationNethod'<br> |
|---|
| 156 | <strong>OPTION_CryptoKey</strong> = 'cryptoKey'<br> |
|---|
| 157 | <strong>OPTION_CryptoKeyIsCert</strong> = 'cryptoKeyIsCert'<br> |
|---|
| 158 | <strong>OPTION_CryptoKeyIsFile</strong> = 'cryptoKeyIsFile'<br> |
|---|
| 159 | <strong>OPTION_CryptoKeyPass</strong> = 'cryptoKeyPass'<br> |
|---|
| 160 | <strong>OPTION_multivalued_claims</strong> = 'multivalued_claims'<br> |
|---|
| 161 | <strong>OPTION_optional_claims</strong> = 'optional_claims'<br> |
|---|
| 162 | <strong>OPTION_required_claims</strong> = 'required_claims'<br> |
|---|
| 163 | <strong>SAML_1_0_ASSERT_NS</strong> = 'urn:oasis:names:tc:SAML:1.0:assertion'<br> |
|---|
| 164 | <strong>SAML_1_1_ASSERT_NS</strong> = 'http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1'<br> |
|---|
| 165 | <strong>SAML_2_0_ASSERT_NS</strong> = 'urn:oasis:names:tc:SAML:2.0:assertion'<br> |
|---|
| 166 | <strong>SENDER_VOUCHES_TOKEN</strong> = 'urn:oasis:names:tc:SAML:1.0:cm:sender-vouches'</td></tr></table> |
|---|
| 167 | </body></html> |
|---|
