oi>dZddlZddlZejZGddZGddeZGddeZed krd Zej ej zej zej zej zZejdeejdd\ZZeejZed eeeee Zeee ZedejdejddZdZdZejrereedj redz Ze!e\Z"Zedezejreedj dkrnJedz Ze!e\Z"Zedezejereedj edej#edej$dZ%e&e%Z'e(e%e'e)e%\Z*Z'e+e*e'Z,e,e%ksJe-e%Z.e/e.\Z0Z1ede1e%e0ksJe-e%dZ.e/e.\Z0Z1ede1e%e0ksJeddSdS)a6 Helper classes for SSPI authentication via the win32security module. SSPI authentication involves a token-exchange "dance", the exact details of which depends on the authentication provider used. There are also a number of complex flags and constants that need to be used - in most cases, there are reasonable defaults. These classes attempt to hide these details from you until you really need to know. They are not designed to handle all cases, just the common ones. If you need finer control than offered here, just use the win32security functions directly. NcLeZdZdZdZdZdZdZdZdZ dZ d d Z d Z d S) _BaseAuthc.|dS)N)resetselfs >C:\PYTHON\Scheduler\python\Lib\site-packages\win32/lib/sspi.py__init__z_BaseAuth.__init__s cLd|_d|_d|_d|_d|_dS)z)Reset everything to an unauthorized stateNFr)ctxt authenticatedinitiator_name service_name next_seq_numrs r rz_BaseAuth.resets1;? "" r c4|j}|xjdz c_|S)zsGet the next sequence number for a transmission. Default implementation is to increment a counter )r)rrets r _get_next_seq_numz_BaseAuth._get_next_seq_num%s% Q r c |jtj}|d}t j}|t jt|tj |t j|tj ||d_ |j d|| |dj |dj fS)zEncrypt a string, returning a tuple of (encrypted_data, trailer). These can be passed to decrypt to get back the original string. SecurityTrailerrr)r QueryContextAttributessspiconSECPKG_ATTR_SIZES win32securityPySecBufferDescTypeappendPySecBufferTypelenSECBUFFER_DATASECBUFFER_TOKENBufferEncryptMessager)rdata pkg_size_info trailersizeencbufs r encryptz_BaseAuth.encrypt-s 889RSS #$56 244 m3CIIw?UVVWWW  )+w7N O O    q    FD,B,B,D,DEEEay!111r ctj}|tjt |t j|tjt |t j||d_||d_|j || |djS)zADecrypt a previously encrypted string, returning the orignal datarr) rrrrrrr r!r"r DecryptMessager)rr$trailerr's r decryptz_BaseAuth.decrypt=s244 m3CIIw?UVVWWW  )#g,,8O P P    q "q    )?)?)A)ABBBayr c|jtj}|d}t j}|t jt|tj |t j|tj ||d_ |j d|| |dj S)zsign a string suitable for transmission, returning the signature. Passing the data and signature to verify will determine if the data is unchanged. MaxSignaturerr)r rrrrrrrrr r!r" MakeSignaturer)rr$r%sigsizesigbufs r signz_BaseAuth.signIs  889RSS /244 m3CIIw?UVVWWW m3GW=TUUVVVq  64+A+A+C+CDDDayr ctj}|tjt |t j|tjt |t j||d_||d_|j || dS)zgVerifies data and its signature. If verification fails, an sspi.error will be raised. rrN) rrrrrrr r!r"r VerifySignaturer)rr$sigr1s r verifyz_BaseAuth.verifyXs244 m3CIIw?UVVWWW m3CHHg>UVVWWWq q  !!&$*@*@*B*BCCCCCr ctj}|tjt |t j||d_|tjdt j|j || }|dj}||t j k fS)a< GSSAPI's unwrap with SSPI. https://learn.microsoft.com/en-us/windows/win32/secauthn/sspi-kerberos-interoperability-with-gssapi Usable mainly with Kerberos SSPI package, but this is not enforced. Return the clear text, and a boolean that is True if the token was encrypted. rr) rrrrrrSECBUFFER_STREAMr"r r r*rSECQOP_WRAP_NO_ENCRYPT)rtokenbufferpfQOPrs r unwrapz_BaseAuth.unwrapds244  )#e**g6N O O   !q   m3Aw7MNNOOO ((1G1G1I1IJJ 1I u >>???r Fc|jtj}|d}|d}t j}|t jt|tj ||d_ |t j|tj |t j|tj |rdn tj }|j||||dj |dj z|dj z}|S)a7 GSSAPI's wrap with SSPI. https://learn.microsoft.com/en-us/windows/win32/secauthn/sspi-kerberos-interoperability-with-gssapi Usable mainly with Kerberos SSPI package, but this is not enforced. Wrap a message to be sent to the other side. Encrypted if encrypt is True. r BlockSizerr)r rrrrrrrrr r"r!SECBUFFER_PADDINGr9r#r) rmsgr( size_info trailer_size block_sizer;fQOPr=s r wrapz_BaseAuth.wrap}s/I44W5NOO  !23 {+ 244  m3CHHg>TUUVVVq    ),8O P P     )*g6O P P   ?qq!?   vt/E/E/G/GHHH 1I vay/ /&)2B Br c|jstd |jtj}|\|_|_dS#t$rYdSwxYw)zHAdds initiator and service names in the security context for ease of usez+Sec context is not completely authenticatedN) r ValueErrorr rrSECPKG_ATTR_NATIVE_NAMESrrerror)rnamess r _amend_ctx_namez_BaseAuth._amend_ctx_namesv! LJKK K ;I44W5UVVE 6; 2D !2!2!2     DD s$A AAN)F) __name__ __module__ __qualname__r rrr(r,r2r6r>rHrNr r rrs222         D D D@@@2####J ; ; ; ; ;r rc4eZdZdZddddejfdZdZdS) ClientAuthz;Manages the client side of an SSPI authentication handshakeNct|3tjtjztjztjz}||_||_||_tj ||_ tj ||j dtj d|\|_ |_t|dSNName)rISC_REQ_INTEGRITYISC_REQ_SEQUENCE_DETECTISC_REQ_REPLAY_DETECTISC_REQ_CONFIDENTIALITYscflagsdatarep targetspnrQuerySecurityPackageInfopkg_infoAcquireCredentialsHandleSECPKG_CRED_OUTBOUND credentialscredentials_expiryrr )rpkg_name client_name auth_infor^r\r]s r r zClientAuth.__init__s ?)12/012    "%>xHH   2  M& !  (         # 4     r c (|ut|tjs[tj}tj|jdt j}||_|||}tj}tj|jdt j}|||j }|j tj |_ tj |j ||j |j|j||j |\}}}||_||_|t jt jfvr|j ||dk|_|jr|||fS)zVPerform *one* step of the client authentication process. Pass None for the first roundNMaxTokenr) isinstancerrrr`rr!r"rr PyCtxtHandleTypeInitializeSecurityContextrcr^r\r] ctxt_attr ctxt_expirySEC_I_COMPLETE_NEEDEDSEC_I_COMPLETE_AND_CONTINUECompleteAuthTokenrrN r sec_buffer_insec_buffer_newtokenbufsec_buffer_outctxtinerrattrexps r authorizezClientAuth.authorizes  $Z =<. . $+>@@N$4 j)7+BH,HO  ! !( + + +*M&:<< 0 M* %w'>   h''' 9 %688DI&@    N L L  I    T3 70'2UV V V I ' ' 7 7 7 AX   #  " " "N""r rOrPrQ__doc__rSECURITY_NETWORK_DREPr r{rRr r rTrTsREE -!!!!@,#,#,#,#,#r rTc0eZdZdZddejfdZdZdS) ServerAuthz;Manages the server side of an SSPI authentication handshakeNct||_||_|3tjtjztjztjz}||_tj ||_ tj ||j dtj dd\|_ |_t|dSrV)spnr]rASC_REQ_INTEGRITYASC_REQ_SEQUENCE_DETECTASC_REQ_REPLAY_DETECTASC_REQ_CONFIDENTIALITYr\rr_r`raSECPKG_CRED_INBOUNDrcrdrr )rrerr\r]s r r zServerAuth.__init__s ?)12/012  %>xHH  2 v&(CT4      # 4     r c |ut|tjs[tj}tj|jdt j}||_|||}tj}tj|jdt j}|||j }|j tj |_ tj |j |||j |j|j |\}}}||_||_|t jt jfvr|j ||dk|_|jr|||fS)z8Perform *one* step of the server authentication process.Nrir)rjrrrr`rr!r"rr rkAcceptSecurityContextrcr\r]rmrnrorprqrrNrrs r r{zServerAuth.authorize s}  $Z =<. . $+>@@N$4 j)7+BH,HO  ! !( + + +*M&:<< 0 M* %w'>   h''' 9 %688DI&<     L L I   T3 70'2UV V V I ' ' 7 7 7 AX   #  " " "N""r r|rRr r rrsIEE!$8U!!!!6-#-#-#-#-#r r__main__KerberoszWe are:)r\r^)r\z SSP : {} ({})rWCommentrzClient step %szServer step %sz%Initiator name from the service side:z%Service name from the client side: shelloz encrypted ?T)r(zcool!)2r}rrrLrrTrrOsspISC_REQ_MUTUAL_AUTHrXrYr[rZflagsrar cred_handlerzQueryCredentialsAttributesSECPKG_CRED_ATTR_NAMEScredprint sspiclient sspiserverformatr` sec_buffer client_step server_steprrr"r{rxrrr$r2r5r6r( encryptedr, decryptedrHwrappedr> unwrapped was_encryptedrRr r rs$   V;V;V;V;V;V;V;V;rO#O#O#O#O#O#O#O#dK#K#K#K#K#K#K#K#\ z C #  # $  ) *  ) *  '  ( >}= c7.dK  1 1'2P Q QD E)TC$???JC///J E   ')R:S:S .q $..z::Z ,---  # JqM,@(A(AQ(F(F q $..z::Z ,---& .: .##jm>R:S:S . E 1:3LMMM E 1:3JKKK D //$  CdC    ''--NIs""9c22I     ood##G)0099I} E-''' 9    oodDo11G)0099I} E-''' 9     E'NNNNN[r