Skip to content
GitLab
Menu
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
Tryton
Tryton
Commits
74c775b71e35
Commit
74c775b7
authored
Jan 25, 2023
by
edbo
Browse files
Fix comments
parent
c2e1c3600121
Pipeline
#61790
passed with stages
in 16 minutes and 58 seconds
Changes
6
Pipelines
1
Hide whitespace changes
Inline
Side-by-side
modules/authentication_kerberos/doc/configuration.rst
View file @
74c775b7
...
...
@@ -2,6 +2,6 @@
Configuration
*************
The *Authentication Kerberos Module*
introduces new
authentication
services
from settings
in the ``[authentication_kerberos]`` section of the
The *Authentication Kerberos Module*
allows new Kerberos
authentication
servers to be defined
in the ``[authentication_kerberos]`` section of the
:doc:`configuration file <trytond:topics/configuration>`.
...
...
@@ -7,6 +7,4 @@
:doc:`configuration file <trytond:topics/configuration>`.
The section lists the Kerberos service to setup with the string to display to
the user.
Each service can be configuration with a section named
``[authentication_kerberos <service>]`` with the following options.
The line must contain a name for the server along with the string that is
displayed to the user.
...
...
@@ -12,5 +10,10 @@
Example::
Each Kerberos server is then configured separately in a section
named ``[authentication_kerberos <name>]`` using the options listed below.
Example:
.. code-block:: ini
[authentication_kerberos]
domain = SSO login
...
...
@@ -20,6 +23,7 @@
service = HTTP
.. note::
Depending on the service provider, you may need to add its origins to the
``cors`` value in the ``[web]`` section of the :doc:`configuration file
<trytond:topics/configuration>`.
...
...
@@ -31,5 +35,5 @@
The absolute path to the Kerberos keytab file.
D
efault
:
/etc/krb5.keytab
The d
efault
value is: ``
/etc/krb5.keytab
``
...
...
@@ -35,8 +39,8 @@
.. _config-authentication_kerberos.
realm
:
.. _config-authentication_kerberos.
service
:
``service``
===========
The name of the service in the keytab file.
...
...
@@ -37,7 +41,7 @@
``service``
===========
The name of the service in the keytab file.
D
efault: ``HTTP``
The d
efault
value is
: ``HTTP``
modules/authentication_kerberos/doc/design.rst
View file @
74c775b7
...
...
@@ -2,7 +2,7 @@
Design
******
The *Authentication Kerberos Module* introduce a new route:
The *Authentication Kerberos Module* introduce
s
a new route:
- ``GET`` ``/<database>/authentication/kerberos/<identity>/login``:
verify the authentication request and redirect to the the ``next``
...
...
modules/authentication_kerberos/doc/index.rst
View file @
74c775b7
...
...
@@ -2,8 +2,11 @@
Authentication Kerberos Module
##############################
The `Kerberos <https://en.wikipedia.org/wiki/Kerberos_(protocol)>`_
authentication module allows to authenticate an user with it's Kerberos ticket.
The *Kerberos Authentication Module* allows a user to be authenticated from
a Kerberos_ ticket.
.. _Kerberos: https://en.wikipedia.org/wiki/Kerberos%5F%28protocol%29
.. toctree::
:maxdepth: 2
...
...
modules/authentication_kerberos/routes.py
View file @
74c775b7
...
...
@@ -16,7 +16,7 @@
from
trytond.wsgi
import
app
logger
=
logging
.
getLogger
(
__name__
)
IDENTITIE
S
=
set
()
AUTH_SERVER
S
=
set
()
CONFIG_KERBEROS
=
{}
if
config
.
has_section
(
'authentication_kerberos'
):
...
...
@@ -20,7 +20,7 @@
CONFIG_KERBEROS
=
{}
if
config
.
has_section
(
'authentication_kerberos'
):
for
identity
in
config
.
options
(
'authentication_kerberos'
):
IDENTITIES
.
add
(
identity
)
name
=
config
.
get
(
'authentication_kerberos'
,
identity
)
for
auth_server
in
config
.
options
(
'authentication_kerberos'
):
AUTH_SERVERS
.
add
(
auth_server
)
name
=
config
.
get
(
'authentication_kerberos'
,
auth_server
)
register_authentication_service
(
...
...
@@ -26,3 +26,3 @@
register_authentication_service
(
name
,
f
'/authentication/kerberos/
{
identity
}
/login'
)
name
,
f
'/authentication/kerberos/
{
auth_server
}
/login'
)
...
...
@@ -28,3 +28,3 @@
CONFIG_KERBEROS
[
identity
]
=
{
CONFIG_KERBEROS
[
auth_server
]
=
{
'keytab'
:
config
.
get
(
...
...
@@ -30,4 +30,4 @@
'keytab'
:
config
.
get
(
f
'authentication_kerberos
{
identity
}
'
,
'keytab'
,
f
'authentication_kerberos
{
auth_server
}
'
,
'keytab'
,
default
=
'/etc/krb5.keytab'
),
'service'
:
config
.
get
(
...
...
@@ -32,6 +32,6 @@
default
=
'/etc/krb5.keytab'
),
'service'
:
config
.
get
(
f
'authentication_kerberos
{
identity
}
'
,
'service'
,
f
'authentication_kerberos
{
auth_server
}
'
,
'service'
,
default
=
'HTTP'
),
'host'
:
host
()
}
...
...
@@ -48,10 +48,12 @@
redirect_url
=
http_host
()
parts
=
urllib
.
parse
.
urlsplit
(
redirect_url
)
query
=
urllib
.
parse
.
parse_qsl
(
parts
.
query
)
query
.
append
((
'database'
,
database
))
query
.
append
((
'login'
,
login
))
query
.
append
((
'user_id'
,
user_id
))
query
.
append
((
'session'
,
session
))
query
.
extend
([
(
'database'
,
database
),
(
'login'
,
login
),
(
'user_id'
,
user_id
),
(
'session'
,
session
)
])
parts
=
list
(
parts
)
parts
[
3
]
=
urllib
.
parse
.
urlencode
(
query
)
...
...
@@ -73,5 +75,5 @@
return
redirect
(
urllib
.
parse
.
urlunsplit
(
parts
))
def
check_
identity
(
func
):
def
check_
auth_server
(
func
):
@
wraps
(
func
)
...
...
@@ -77,4 +79,4 @@
@
wraps
(
func
)
def
wrapper
(
request
,
database
,
identity
,
*
args
,
**
kwargs
):
if
identity
not
in
IDENTITIE
S
:
def
wrapper
(
request
,
database
,
auth_server
,
*
args
,
**
kwargs
):
if
auth_server
not
in
AUTH_SERVER
S
:
return
_forbidden
(
request
,
database
)
...
...
@@ -80,6 +82,6 @@
return
_forbidden
(
request
,
database
)
return
func
(
request
,
database
,
identity
,
*
args
,
**
kwargs
)
return
func
(
request
,
database
,
auth_server
,
*
args
,
**
kwargs
)
return
wrapper
@
app
.
route
(
...
...
@@ -82,9 +84,9 @@
return
wrapper
@
app
.
route
(
'/<database_name>/authentication/kerberos/<
identity
>/login'
,
'/<database_name>/authentication/kerberos/<
auth_server
>/login'
,
methods
=
{
'GET'
})
@
allow_null_origin
@
with_pool
@
with_transaction
()
...
...
@@ -87,9 +89,9 @@
methods
=
{
'GET'
})
@
allow_null_origin
@
with_pool
@
with_transaction
()
@
check_
identity
def
login
(
request
,
pool
,
identity
):
@
check_
auth_server
def
login
(
request
,
pool
,
auth_server
):
Session
=
pool
.
get
(
'ir.session'
)
User
=
pool
.
get
(
'res.user'
)
database
=
pool
.
database_name
...
...
@@ -97,9 +99,9 @@
in_token
=
base64
.
b64decode
(
request
.
headers
[
'Authorization'
][
10
:])
try
:
service
=
CONFIG_KERBEROS
[
identity
][
'service'
]
keytab
=
CONFIG_KERBEROS
[
identity
][
'keytab'
]
host
=
CONFIG_KERBEROS
[
identity
][
'host'
]
service
=
CONFIG_KERBEROS
[
auth_server
][
'service'
]
keytab
=
CONFIG_KERBEROS
[
auth_server
][
'keytab'
]
host
=
CONFIG_KERBEROS
[
auth_server
][
'host'
]
service_name
=
f
'
{
service
}
@
{
host
}
'
name
=
gssapi
.
Name
(
service_name
,
gssapi
.
NameType
.
hostbased_service
)
creds
=
gssapi
.
Credentials
(
name
=
name
,
usage
=
'accept'
,
store
=
{
...
...
@@ -107,6 +109,6 @@
})
except
KeyError
:
raise
RuntimeError
(
'flask-gssapi not configured
right
'
)
raise
RuntimeError
(
'flask-gssapi not configured
correctly
'
)
ctx
=
gssapi
.
SecurityContext
(
creds
=
creds
,
usage
=
'accept'
)
...
...
@@ -111,6 +113,6 @@
ctx
=
gssapi
.
SecurityContext
(
creds
=
creds
,
usage
=
'accept'
)
out_token
=
ctx
.
step
(
in_token
)
# noqa: F841
ctx
.
step
(
in_token
)
if
ctx
.
complete
:
username
=
ctx
.
initiator_name
...
...
modules/authentication_kerberos/setup.py
View file @
74c775b7
...
...
@@ -54,7 +54,8 @@
setup
(
name
=
name
,
version
=
version
,
description
=
'Tryton module to authenticate users using Kerberos ticket'
,
description
=
"Tryton module that allows a user to be authenticated from "
"a Kerberos ticket"
,
long_description
=
read
(
'README.rst'
),
author
=
'Tryton'
,
author_email
=
'foundation@tryton.org'
,
...
...
modules/authentication_kerberos/tryton.cfg
View file @
74c775b7
...
...
@@ -2,4 +2,4 @@
version=6.7.0
depends:
ir
xml:
res
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment