<s> """<STR_LIT>""" <EOL> import hmac <EOL> try : <EOL> import hashlib <EOL> _MD5 = hashlib . md5 <EOL> _DMOD = _MD5 <EOL> except ImportError : <EOL> import md5 <EOL> _MD5 = md5 . new <EOL> _DMOD = md5 <EOL> HAVE_KERBEROS = True <EOL> try : <EOL> import kerberos <EOL> except ImportError : <EOL> HAVE_KERBEROS = False <EOL> from bson . binary import Binary <EOL> from bson . py3compat import b <EOL> from bson . son import SON <EOL> from pymongo . errors import ConfigurationError , OperationFailure <EOL> MECHANISMS = frozenset ( [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] ) <EOL> """<STR_LIT>""" <EOL> def _build_credentials_tuple ( mech , source , user , passwd , extra ) : <EOL> """<STR_LIT>""" <EOL> if mech == '<STR_LIT>' : <EOL> gsn = extra . get ( '<STR_LIT>' , '<STR_LIT>' ) <EOL> return ( mech , '<STR_LIT>' , user , gsn ) <EOL> elif mech == '<STR_LIT>' : <EOL> return ( mech , '<STR_LIT>' , user ) <EOL> return ( mech , source , user , passwd ) <EOL> def _password_digest ( username , password ) : <EOL> """<STR_LIT>""" <EOL> if not isinstance ( password , basestring ) : <EOL> raise TypeError ( "<STR_LIT>" <EOL> "<STR_LIT>" % ( basestring . __name__ , ) ) <EOL> if len ( password ) == <NUM_LIT:0> : <EOL> raise ValueError ( "<STR_LIT>" ) <EOL> if not isinstance ( username , basestring ) : <EOL> raise TypeError ( "<STR_LIT>" <EOL> "<STR_LIT>" % ( basestring . __name__ , ) ) <EOL> md5hash = _MD5 ( ) <EOL> data = "<STR_LIT>" % ( username , password ) <EOL> md5hash . update ( data . encode ( '<STR_LIT:utf-8>' ) ) <EOL> return unicode ( md5hash . hexdigest ( ) ) <EOL> def _auth_key ( nonce , username , password ) : <EOL> """<STR_LIT>""" <EOL> digest = _password_digest ( username , password ) <EOL> md5hash = _MD5 ( ) <EOL> data = "<STR_LIT>" % ( nonce , unicode ( username ) , digest ) <EOL> md5hash . update ( data . encode ( '<STR_LIT:utf-8>' ) ) <EOL> return unicode ( md5hash . hexdigest ( ) ) <EOL> def _authenticate_gssapi ( credentials , sock_info , cmd_func ) : <EOL> """<STR_LIT>""" <EOL> try : <EOL> dummy , username , gsn = credentials <EOL> result , ctx = kerberos . authGSSClientInit ( gsn + '<STR_LIT:@>' + sock_info . host , <EOL> kerberos . GSS_C_MUTUAL_FLAG ) <EOL> if result != kerberos . AUTH_GSS_COMPLETE : <EOL> raise OperationFailure ( '<STR_LIT>' ) <EOL> try : <EOL> if kerberos . authGSSClientStep ( ctx , '<STR_LIT>' ) != <NUM_LIT:0> : <EOL> raise OperationFailure ( '<STR_LIT>' <EOL> '<STR_LIT>' ) <EOL> payload = kerberos . authGSSClientResponse ( ctx ) <EOL> cmd = SON ( [ ( '<STR_LIT>' , <NUM_LIT:1> ) , <EOL> ( '<STR_LIT>' , '<STR_LIT>' ) , <EOL> ( '<STR_LIT>' , payload ) , <EOL> ( '<STR_LIT>' , <NUM_LIT:1> ) ] ) <EOL> response , _ = cmd_func ( sock_info , '<STR_LIT>' , cmd ) <EOL> for _ in xrange ( <NUM_LIT:10> ) : <EOL> result = kerberos . authGSSClientStep ( ctx , <EOL> str ( response [ '<STR_LIT>' ] ) ) <EOL> if result == - <NUM_LIT:1> : <EOL> raise OperationFailure ( '<STR_LIT>' <EOL> '<STR_LIT>' ) <EOL> payload = kerberos . authGSSClientResponse ( ctx ) or '<STR_LIT>' <EOL> cmd = SON ( [ ( '<STR_LIT>' , <NUM_LIT:1> ) , <EOL> ( '<STR_LIT>' , response [ '<STR_LIT>' ] ) , <EOL> ( '<STR_LIT>' , payload ) ] ) <EOL> response , _ = cmd_func ( sock_info , '<STR_LIT>' , cmd ) <EOL> if result == kerberos . AUTH_GSS_COMPLETE : <EOL> break <EOL> else : <EOL> raise OperationFailure ( '<STR_LIT>' <EOL> '<STR_LIT>' ) <EOL> if kerberos . authGSSClientUnwrap ( ctx , <EOL> str ( response [ '<STR_LIT>' ] ) ) != <NUM_LIT:1> : <EOL> raise OperationFailure ( '<STR_LIT>' <EOL> '<STR_LIT>' ) <EOL> if kerberos . authGSSClientWrap ( ctx , <EOL> kerberos . authGSSClientResponse ( ctx ) , <EOL> username ) != <NUM_LIT:1> : <EOL> raise OperationFailure ( '<STR_LIT>' <EOL> '<STR_LIT>' ) <EOL> payload = kerberos . authGSSClientResponse ( ctx ) <EOL> cmd = SON ( [ ( '<STR_LIT>' , <NUM_LIT:1> ) , <EOL> ( '<STR_LIT>' , response [ '<STR_LIT>' ] ) , <EOL> ( '<STR_LIT>' , payload ) ] ) <EOL> response , _ = cmd_func ( sock_info , '<STR_LIT>' , cmd ) <EOL> finally : <EOL> kerberos . authGSSClientClean ( ctx ) <EOL> except kerberos . KrbError , exc : <EOL> raise OperationFailure ( str ( exc ) ) <EOL> def _authenticate_plain ( credentials , sock_info , cmd_func ) : <EOL> """<STR_LIT>""" <EOL> source , username , password = credentials <EOL> payload = ( '<STR_LIT>' % ( username , password ) ) . encode ( '<STR_LIT:utf-8>' ) <EOL> cmd = SON ( [ ( '<STR_LIT>' , <NUM_LIT:1> ) , <EOL> ( '<STR_LIT>' , '<STR_LIT>' ) , <EOL> ( '<STR_LIT>' , Binary ( payload ) ) , <EOL> ( '<STR_LIT>' , <NUM_LIT:1> ) ] ) <EOL> cmd_func ( sock_info , source , cmd ) <EOL> def _authenticate_cram_md5 ( credentials , sock_info , cmd_func ) : <EOL> """<STR_LIT>""" <EOL> source , username , password = credentials <EOL> passwd = _password_digest ( username , password ) <EOL> cmd = SON ( [ ( '<STR_LIT>' , <NUM_LIT:1> ) , <EOL> ( '<STR_LIT>' , '<STR_LIT>' ) , <EOL> ( '<STR_LIT>' , Binary ( b ( '<STR_LIT>' ) ) ) , <EOL> ( '<STR_LIT>' , <NUM_LIT:1> ) ] ) <EOL> response , _ = cmd_func ( sock_info , source , cmd ) <EOL> mac = hmac . HMAC ( key = passwd . encode ( '<STR_LIT:utf-8>' ) , digestmod = _DMOD ) <EOL> mac . update ( response [ '<STR_LIT>' ] ) <EOL> challenge = username . encode ( '<STR_LIT:utf-8>' ) + b ( '<STR_LIT:U+0020>' ) + b ( mac . hexdigest ( ) ) <EOL> cmd = SON ( [ ( '<STR_LIT>' , <NUM_LIT:1> ) , <EOL> ( '<STR_LIT>' , response [ '<STR_LIT>' ] ) , <EOL> ( '<STR_LIT>' , Binary ( challenge ) ) ] ) <EOL> cmd_func ( sock_info , source , cmd ) <EOL> def _authenticate_x509 ( credentials , sock_info , cmd_func ) : <EOL> """<STR_LIT>""" <EOL> dummy , username = credentials <EOL> query = SON ( [ ( '<STR_LIT>' , <NUM_LIT:1> ) , <EOL> ( '<STR_LIT>' , '<STR_LIT>' ) , <EOL> ( '<STR_LIT:user>' , username ) ] ) <EOL> cmd_func ( sock_info , '<STR_LIT>' , query ) <EOL> def _authenticate_mongo_cr ( credentials , sock_info , cmd_func ) : <EOL> """<STR_LIT>""" <EOL> source , username , password = credentials <EOL> response , _ = cmd_func ( sock_info , source , { '<STR_LIT>' : <NUM_LIT:1> } ) <EOL> nonce = response [ '<STR_LIT>' ] <EOL> key = _auth_key ( nonce , username , password ) <EOL> query = SON ( [ ( '<STR_LIT>' , <NUM_LIT:1> ) , <EOL> ( '<STR_LIT:user>' , username ) , <EOL> ( '<STR_LIT>' , nonce ) , <EOL> ( '<STR_LIT:key>' , key ) ] ) <EOL> cmd_func ( sock_info , source , query ) <EOL> _AUTH_MAP = { <EOL> '<STR_LIT>' : _authenticate_cram_md5 , <EOL> '<STR_LIT>' : _authenticate_gssapi , <EOL> '<STR_LIT>' : _authenticate_mongo_cr , <EOL> '<STR_LIT>' : _authenticate_x509 , <EOL> '<STR_LIT>' : _authenticate_plain , <EOL> } <EOL> def authenticate ( credentials , sock_info , cmd_func ) : <EOL> """<STR_LIT>""" <EOL> mechanism = credentials [ <NUM_LIT:0> ] <EOL> if mechanism == '<STR_LIT>' : <EOL> if not HAVE_KERBEROS : <EOL> raise ConfigurationError ( '<STR_LIT>' <EOL> '<STR_LIT>' ) <EOL> auth_func = _AUTH_MAP . get ( mechanism ) <EOL> auth_func ( credentials [ <NUM_LIT:1> : ] , sock_info , cmd_func ) </s>
