2 Unix SMB/CIFS implementation.
3 Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
5 This program is free software; you can redistribute it and/or modify
6 it under the terms of the GNU General Public License as published by
7 the Free Software Foundation; either version 3 of the License, or
8 (at your option) any later version.
10 This program is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 GNU General Public License for more details.
15 You should have received a copy of the GNU General Public License
16 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 #include "python/py3compat.h"
22 #include "pycredentials.h"
23 #include "param/param.h"
24 #include "lib/cmdline/credentials.h"
25 #include "auth/credentials/credentials_internal.h"
26 #include "librpc/gen_ndr/samr.h" /* for struct samr_Password */
27 #include "librpc/gen_ndr/netlogon.h"
28 #include "libcli/util/pyerrors.h"
29 #include "libcli/auth/libcli_auth.h"
30 #include "param/pyparam.h"
32 #include "libcli/auth/libcli_auth.h"
33 #include "auth/credentials/credentials_internal.h"
34 #include "system/kerberos.h"
35 #include "auth/kerberos/kerberos.h"
37 void initcredentials(void);
39 static PyObject *PyString_FromStringOrNULL(const char *str)
43 return PyStr_FromString(str);
46 static PyObject *py_creds_new(PyTypeObject *type, PyObject *args, PyObject *kwargs)
48 return pytalloc_steal(type, cli_credentials_init(NULL));
51 static PyObject *py_creds_get_username(PyObject *self, PyObject *unused)
53 return PyString_FromStringOrNULL(cli_credentials_get_username(PyCredentials_AsCliCredentials(self)));
56 static PyObject *py_creds_set_username(PyObject *self, PyObject *args)
59 enum credentials_obtained obt = CRED_SPECIFIED;
62 if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
67 return PyBool_FromLong(cli_credentials_set_username(PyCredentials_AsCliCredentials(self), newval, obt));
70 static PyObject *py_creds_get_ntlm_username_domain(PyObject *self, PyObject *unused)
72 TALLOC_CTX *frame = talloc_stackframe();
73 const char *user = NULL;
74 const char *domain = NULL;
76 cli_credentials_get_ntlm_username_domain(PyCredentials_AsCliCredentials(self),
77 frame, &user, &domain);
78 ret = Py_BuildValue("(OO)",
79 PyString_FromStringOrNULL(user),
80 PyString_FromStringOrNULL(domain));
85 static PyObject *py_creds_get_ntlm_response(PyObject *self, PyObject *args, PyObject *kwargs)
87 TALLOC_CTX *frame = talloc_stackframe();
90 struct timeval tv_now;
91 NTTIME server_timestamp;
92 DATA_BLOB challenge = data_blob_null;
93 DATA_BLOB target_info = data_blob_null;
95 DATA_BLOB lm_response = data_blob_null;
96 DATA_BLOB nt_response = data_blob_null;
97 DATA_BLOB lm_session_key = data_blob_null;
98 DATA_BLOB nt_session_key = data_blob_null;
99 const char *kwnames[] = { "flags", "challenge",
103 tv_now = timeval_current();
104 server_timestamp = timeval_to_nttime(&tv_now);
106 if (!PyArg_ParseTupleAndKeywords(args, kwargs, "is#|s#",
107 discard_const_p(char *, kwnames),
112 &target_info.length)) {
116 status = cli_credentials_get_ntlm_response(PyCredentials_AsCliCredentials(self),
121 &lm_response, &nt_response,
122 &lm_session_key, &nt_session_key);
124 if (!NT_STATUS_IS_OK(status)) {
125 PyErr_SetNTSTATUS(status);
130 ret = Py_BuildValue("{sis" PYARG_BYTES_LEN "s" PYARG_BYTES_LEN
131 "s" PYARG_BYTES_LEN "s" PYARG_BYTES_LEN "}",
134 (const char *)lm_response.data, lm_response.length,
136 (const char *)nt_response.data, nt_response.length,
138 (const char *)lm_session_key.data, lm_session_key.length,
140 (const char *)nt_session_key.data, nt_session_key.length);
145 static PyObject *py_creds_get_principal(PyObject *self, PyObject *unused)
147 TALLOC_CTX *frame = talloc_stackframe();
148 PyObject *ret = PyString_FromStringOrNULL(cli_credentials_get_principal(PyCredentials_AsCliCredentials(self), frame));
153 static PyObject *py_creds_set_principal(PyObject *self, PyObject *args)
156 enum credentials_obtained obt = CRED_SPECIFIED;
159 if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
164 return PyBool_FromLong(cli_credentials_set_principal(PyCredentials_AsCliCredentials(self), newval, obt));
167 static PyObject *py_creds_get_password(PyObject *self, PyObject *unused)
169 return PyString_FromStringOrNULL(cli_credentials_get_password(PyCredentials_AsCliCredentials(self)));
172 static PyObject *py_creds_set_password(PyObject *self, PyObject *args)
174 const char *newval = NULL;
175 enum credentials_obtained obt = CRED_SPECIFIED;
177 PyObject *result = NULL;
178 if (!PyArg_ParseTuple(args, "es|i", "utf8", &newval, &_obt)) {
183 result = PyBool_FromLong(cli_credentials_set_password(PyCredentials_AsCliCredentials(self), newval, obt));
184 PyMem_Free(discard_const_p(void*, newval));
188 static PyObject *py_creds_set_utf16_password(PyObject *self, PyObject *args)
190 enum credentials_obtained obt = CRED_SPECIFIED;
192 PyObject *newval = NULL;
193 DATA_BLOB blob = data_blob_null;
198 if (!PyArg_ParseTuple(args, "O|i", &newval, &_obt)) {
203 result = PyBytes_AsStringAndSize(newval, (char **)&blob.data, &size);
205 PyErr_SetString(PyExc_RuntimeError, "Failed to convert passed value to Bytes");
210 ok = cli_credentials_set_utf16_password(PyCredentials_AsCliCredentials(self),
213 return PyBool_FromLong(ok);
216 static PyObject *py_creds_get_old_password(PyObject *self, PyObject *unused)
218 return PyString_FromStringOrNULL(cli_credentials_get_old_password(PyCredentials_AsCliCredentials(self)));
221 static PyObject *py_creds_set_old_password(PyObject *self, PyObject *args)
224 enum credentials_obtained obt = CRED_SPECIFIED;
227 if (!PyArg_ParseTuple(args, "s|i", &oldval, &_obt)) {
232 return PyBool_FromLong(cli_credentials_set_old_password(PyCredentials_AsCliCredentials(self), oldval, obt));
235 static PyObject *py_creds_set_old_utf16_password(PyObject *self, PyObject *args)
237 PyObject *oldval = NULL;
238 DATA_BLOB blob = data_blob_null;
243 if (!PyArg_ParseTuple(args, "O", &oldval)) {
247 result = PyBytes_AsStringAndSize(oldval, (char **)&blob.data, &size);
249 PyErr_SetString(PyExc_RuntimeError, "Failed to convert passed value to Bytes");
254 ok = cli_credentials_set_old_utf16_password(PyCredentials_AsCliCredentials(self),
257 return PyBool_FromLong(ok);
260 static PyObject *py_creds_get_domain(PyObject *self, PyObject *unused)
262 return PyString_FromStringOrNULL(cli_credentials_get_domain(PyCredentials_AsCliCredentials(self)));
265 static PyObject *py_creds_set_domain(PyObject *self, PyObject *args)
268 enum credentials_obtained obt = CRED_SPECIFIED;
271 if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
276 return PyBool_FromLong(cli_credentials_set_domain(PyCredentials_AsCliCredentials(self), newval, obt));
279 static PyObject *py_creds_get_realm(PyObject *self, PyObject *unused)
281 return PyString_FromStringOrNULL(cli_credentials_get_realm(PyCredentials_AsCliCredentials(self)));
284 static PyObject *py_creds_set_realm(PyObject *self, PyObject *args)
287 enum credentials_obtained obt = CRED_SPECIFIED;
290 if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
295 return PyBool_FromLong(cli_credentials_set_realm(PyCredentials_AsCliCredentials(self), newval, obt));
298 static PyObject *py_creds_get_bind_dn(PyObject *self, PyObject *unused)
300 return PyString_FromStringOrNULL(cli_credentials_get_bind_dn(PyCredentials_AsCliCredentials(self)));
303 static PyObject *py_creds_set_bind_dn(PyObject *self, PyObject *args)
306 if (!PyArg_ParseTuple(args, "s", &newval))
309 return PyBool_FromLong(cli_credentials_set_bind_dn(PyCredentials_AsCliCredentials(self), newval));
312 static PyObject *py_creds_get_workstation(PyObject *self, PyObject *unused)
314 return PyString_FromStringOrNULL(cli_credentials_get_workstation(PyCredentials_AsCliCredentials(self)));
317 static PyObject *py_creds_set_workstation(PyObject *self, PyObject *args)
320 enum credentials_obtained obt = CRED_SPECIFIED;
323 if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
328 return PyBool_FromLong(cli_credentials_set_workstation(PyCredentials_AsCliCredentials(self), newval, obt));
331 static PyObject *py_creds_is_anonymous(PyObject *self, PyObject *unused)
333 return PyBool_FromLong(cli_credentials_is_anonymous(PyCredentials_AsCliCredentials(self)));
336 static PyObject *py_creds_set_anonymous(PyObject *self, PyObject *unused)
338 cli_credentials_set_anonymous(PyCredentials_AsCliCredentials(self));
342 static PyObject *py_creds_authentication_requested(PyObject *self, PyObject *unused)
344 return PyBool_FromLong(cli_credentials_authentication_requested(PyCredentials_AsCliCredentials(self)));
347 static PyObject *py_creds_wrong_password(PyObject *self, PyObject *unused)
349 return PyBool_FromLong(cli_credentials_wrong_password(PyCredentials_AsCliCredentials(self)));
352 static PyObject *py_creds_set_cmdline_callbacks(PyObject *self, PyObject *unused)
354 return PyBool_FromLong(cli_credentials_set_cmdline_callbacks(PyCredentials_AsCliCredentials(self)));
357 static PyObject *py_creds_parse_string(PyObject *self, PyObject *args)
360 enum credentials_obtained obt = CRED_SPECIFIED;
363 if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
368 cli_credentials_parse_string(PyCredentials_AsCliCredentials(self), newval, obt);
372 static PyObject *py_creds_parse_file(PyObject *self, PyObject *args)
375 enum credentials_obtained obt = CRED_SPECIFIED;
378 if (!PyArg_ParseTuple(args, "s|i", &newval, &_obt)) {
383 cli_credentials_parse_file(PyCredentials_AsCliCredentials(self), newval, obt);
387 static PyObject *py_cli_credentials_set_password_will_be_nt_hash(PyObject *self, PyObject *args)
389 struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
390 PyObject *py_val = NULL;
393 if (!PyArg_ParseTuple(args, "O!", &PyBool_Type, &py_val)) {
396 val = PyObject_IsTrue(py_val);
398 cli_credentials_set_password_will_be_nt_hash(creds, val);
402 static PyObject *py_creds_get_nt_hash(PyObject *self, PyObject *unused)
405 struct cli_credentials *creds = PyCredentials_AsCliCredentials(self);
406 struct samr_Password *ntpw = cli_credentials_get_nt_hash(creds, creds);
408 ret = PyBytes_FromStringAndSize(discard_const_p(char, ntpw->hash), 16);
413 static PyObject *py_creds_get_kerberos_state(PyObject *self, PyObject *unused)
415 int state = cli_credentials_get_kerberos_state(PyCredentials_AsCliCredentials(self));
416 return PyInt_FromLong(state);
419 static PyObject *py_creds_set_kerberos_state(PyObject *self, PyObject *args)
422 if (!PyArg_ParseTuple(args, "i", &state))
425 cli_credentials_set_kerberos_state(PyCredentials_AsCliCredentials(self), state);
429 static PyObject *py_creds_set_krb_forwardable(PyObject *self, PyObject *args)
432 if (!PyArg_ParseTuple(args, "i", &state))
435 cli_credentials_set_krb_forwardable(PyCredentials_AsCliCredentials(self), state);
440 static PyObject *py_creds_get_forced_sasl_mech(PyObject *self, PyObject *unused)
442 return PyString_FromStringOrNULL(cli_credentials_get_forced_sasl_mech(PyCredentials_AsCliCredentials(self)));
445 static PyObject *py_creds_set_forced_sasl_mech(PyObject *self, PyObject *args)
448 enum credentials_obtained obt = CRED_SPECIFIED;
451 if (!PyArg_ParseTuple(args, "s", &newval)) {
456 cli_credentials_set_forced_sasl_mech(PyCredentials_AsCliCredentials(self), newval);
460 static PyObject *py_creds_guess(PyObject *self, PyObject *args)
462 PyObject *py_lp_ctx = Py_None;
463 struct loadparm_context *lp_ctx;
465 struct cli_credentials *creds;
467 creds = PyCredentials_AsCliCredentials(self);
469 if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx))
472 mem_ctx = talloc_new(NULL);
473 if (mem_ctx == NULL) {
478 lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
479 if (lp_ctx == NULL) {
480 talloc_free(mem_ctx);
484 cli_credentials_guess(creds, lp_ctx);
486 talloc_free(mem_ctx);
491 static PyObject *py_creds_set_machine_account(PyObject *self, PyObject *args)
493 PyObject *py_lp_ctx = Py_None;
494 struct loadparm_context *lp_ctx;
496 struct cli_credentials *creds;
499 creds = PyCredentials_AsCliCredentials(self);
501 if (!PyArg_ParseTuple(args, "|O", &py_lp_ctx))
504 mem_ctx = talloc_new(NULL);
505 if (mem_ctx == NULL) {
510 lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
511 if (lp_ctx == NULL) {
512 talloc_free(mem_ctx);
516 status = cli_credentials_set_machine_account(creds, lp_ctx);
517 talloc_free(mem_ctx);
519 PyErr_NTSTATUS_IS_ERR_RAISE(status);
524 static PyObject *PyCredentialCacheContainer_from_ccache_container(struct ccache_container *ccc)
526 return pytalloc_reference(&PyCredentialCacheContainer, ccc);
530 static PyObject *py_creds_get_named_ccache(PyObject *self, PyObject *args)
532 PyObject *py_lp_ctx = Py_None;
533 char *ccache_name = NULL;
534 struct loadparm_context *lp_ctx;
535 struct ccache_container *ccc;
536 struct tevent_context *event_ctx;
538 const char *error_string;
539 struct cli_credentials *creds;
542 creds = PyCredentials_AsCliCredentials(self);
544 if (!PyArg_ParseTuple(args, "|Os", &py_lp_ctx, &ccache_name))
547 mem_ctx = talloc_new(NULL);
548 if (mem_ctx == NULL) {
553 lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
554 if (lp_ctx == NULL) {
555 talloc_free(mem_ctx);
559 event_ctx = samba_tevent_context_init(mem_ctx);
561 ret = cli_credentials_get_named_ccache(creds, event_ctx, lp_ctx,
562 ccache_name, &ccc, &error_string);
563 talloc_unlink(mem_ctx, lp_ctx);
565 talloc_steal(ccc, event_ctx);
566 talloc_free(mem_ctx);
567 return PyCredentialCacheContainer_from_ccache_container(ccc);
570 PyErr_SetString(PyExc_RuntimeError, error_string?error_string:"NULL");
572 talloc_free(mem_ctx);
576 static PyObject *py_creds_set_named_ccache(PyObject *self, PyObject *args)
578 struct loadparm_context *lp_ctx = NULL;
579 enum credentials_obtained obt = CRED_SPECIFIED;
580 const char *error_string = NULL;
581 TALLOC_CTX *mem_ctx = NULL;
583 PyObject *py_lp_ctx = Py_None;
587 if (!PyArg_ParseTuple(args, "s|iO", &newval, &_obt, &py_lp_ctx))
590 mem_ctx = talloc_new(NULL);
591 if (mem_ctx == NULL) {
596 lp_ctx = lpcfg_from_py_object(mem_ctx, py_lp_ctx);
597 if (lp_ctx == NULL) {
598 talloc_free(mem_ctx);
602 ret = cli_credentials_set_ccache(PyCredentials_AsCliCredentials(self),
604 newval, CRED_SPECIFIED,
608 PyErr_SetString(PyExc_RuntimeError,
609 error_string != NULL ? error_string : "NULL");
610 talloc_free(mem_ctx);
614 talloc_free(mem_ctx);
618 static PyObject *py_creds_set_gensec_features(PyObject *self, PyObject *args)
620 unsigned int gensec_features;
622 if (!PyArg_ParseTuple(args, "I", &gensec_features))
625 cli_credentials_set_gensec_features(PyCredentials_AsCliCredentials(self), gensec_features);
630 static PyObject *py_creds_get_gensec_features(PyObject *self, PyObject *args)
632 unsigned int gensec_features;
634 gensec_features = cli_credentials_get_gensec_features(PyCredentials_AsCliCredentials(self));
635 return PyInt_FromLong(gensec_features);
638 static PyObject *py_creds_new_client_authenticator(PyObject *self,
641 struct netr_Authenticator auth;
642 struct cli_credentials *creds = NULL;
643 struct netlogon_creds_CredentialState *nc = NULL;
644 PyObject *ret = NULL;
646 creds = PyCredentials_AsCliCredentials(self);
648 PyErr_SetString(PyExc_RuntimeError,
649 "Failed to get credentials from python");
653 nc = creds->netlogon_creds;
655 PyErr_SetString(PyExc_ValueError,
656 "No netlogon credentials cannot make "
657 "client authenticator");
661 netlogon_creds_client_authenticator(
664 ret = Py_BuildValue("{s"PYARG_BYTES_LEN"si}",
666 (const char *) &auth.cred, sizeof(auth.cred),
667 "timestamp", auth.timestamp);
671 static PyObject *py_creds_set_secure_channel_type(PyObject *self, PyObject *args)
673 unsigned int channel_type;
675 if (!PyArg_ParseTuple(args, "I", &channel_type))
678 cli_credentials_set_secure_channel_type(
679 PyCredentials_AsCliCredentials(self),
685 static PyObject *py_creds_get_secure_channel_type(PyObject *self, PyObject *args)
687 enum netr_SchannelType channel_type = SEC_CHAN_NULL;
689 channel_type = cli_credentials_get_secure_channel_type(
690 PyCredentials_AsCliCredentials(self));
692 return PyInt_FromLong(channel_type);
695 static PyObject *py_creds_encrypt_netr_crypt_password(PyObject *self,
698 DATA_BLOB data = data_blob_null;
699 struct cli_credentials *creds = NULL;
700 struct netr_CryptPassword *pwd = NULL;
702 PyObject *py_cp = Py_None;
704 creds = PyCredentials_AsCliCredentials(self);
706 if (!PyArg_ParseTuple(args, "|O", &py_cp)) {
709 pwd = pytalloc_get_type(py_cp, struct netr_CryptPassword);
710 data.length = sizeof(struct netr_CryptPassword);
711 data.data = (uint8_t *)pwd;
712 status = netlogon_creds_session_encrypt(creds->netlogon_creds, data);
714 PyErr_NTSTATUS_IS_ERR_RAISE(status);
719 static PyMethodDef py_creds_methods[] = {
720 { "get_username", py_creds_get_username, METH_NOARGS,
721 "S.get_username() -> username\nObtain username." },
722 { "set_username", py_creds_set_username, METH_VARARGS,
723 "S.set_username(name[, credentials.SPECIFIED]) -> None\n"
724 "Change username." },
725 { "get_principal", py_creds_get_principal, METH_NOARGS,
726 "S.get_principal() -> user@realm\nObtain user principal." },
727 { "set_principal", py_creds_set_principal, METH_VARARGS,
728 "S.set_principal(name[, credentials.SPECIFIED]) -> None\n"
729 "Change principal." },
730 { "get_password", py_creds_get_password, METH_NOARGS,
731 "S.get_password() -> password\n"
732 "Obtain password." },
733 { "get_ntlm_username_domain", py_creds_get_ntlm_username_domain, METH_NOARGS,
734 "S.get_ntlm_username_domain() -> (domain, username)\n"
735 "Obtain NTLM username and domain, split up either as (DOMAIN, user) or (\"\", \"user@realm\")." },
736 { "get_ntlm_response", (PyCFunction)py_creds_get_ntlm_response, METH_VARARGS | METH_KEYWORDS,
737 "S.get_ntlm_response"
738 "(flags, challenge[, target_info]) -> "
739 "(flags, lm_response, nt_response, lm_session_key, nt_session_key)\n"
740 "Obtain LM or NTLM response." },
741 { "set_password", py_creds_set_password, METH_VARARGS,
742 "S.set_password(password[, credentials.SPECIFIED]) -> None\n"
743 "Change password." },
744 { "set_utf16_password", py_creds_set_utf16_password, METH_VARARGS,
745 "S.set_utf16_password(password[, credentials.SPECIFIED]) -> None\n"
746 "Change password." },
747 { "get_old_password", py_creds_get_old_password, METH_NOARGS,
748 "S.get_old_password() -> password\n"
749 "Obtain old password." },
750 { "set_old_password", py_creds_set_old_password, METH_VARARGS,
751 "S.set_old_password(password[, credentials.SPECIFIED]) -> None\n"
752 "Change old password." },
753 { "set_old_utf16_password", py_creds_set_old_utf16_password, METH_VARARGS,
754 "S.set_old_utf16_password(password[, credentials.SPECIFIED]) -> None\n"
755 "Change old password." },
756 { "get_domain", py_creds_get_domain, METH_NOARGS,
757 "S.get_domain() -> domain\n"
758 "Obtain domain name." },
759 { "set_domain", py_creds_set_domain, METH_VARARGS,
760 "S.set_domain(domain[, credentials.SPECIFIED]) -> None\n"
761 "Change domain name." },
762 { "get_realm", py_creds_get_realm, METH_NOARGS,
763 "S.get_realm() -> realm\n"
764 "Obtain realm name." },
765 { "set_realm", py_creds_set_realm, METH_VARARGS,
766 "S.set_realm(realm[, credentials.SPECIFIED]) -> None\n"
767 "Change realm name." },
768 { "get_bind_dn", py_creds_get_bind_dn, METH_NOARGS,
769 "S.get_bind_dn() -> bind dn\n"
771 { "set_bind_dn", py_creds_set_bind_dn, METH_VARARGS,
772 "S.set_bind_dn(bind_dn) -> None\n"
774 { "is_anonymous", py_creds_is_anonymous, METH_NOARGS,
776 { "set_anonymous", py_creds_set_anonymous, METH_NOARGS,
777 "S.set_anonymous() -> None\n"
778 "Use anonymous credentials." },
779 { "get_workstation", py_creds_get_workstation, METH_NOARGS,
781 { "set_workstation", py_creds_set_workstation, METH_VARARGS,
783 { "authentication_requested", py_creds_authentication_requested, METH_NOARGS,
785 { "wrong_password", py_creds_wrong_password, METH_NOARGS,
786 "S.wrong_password() -> bool\n"
787 "Indicate the returned password was incorrect." },
788 { "set_cmdline_callbacks", py_creds_set_cmdline_callbacks, METH_NOARGS,
789 "S.set_cmdline_callbacks() -> bool\n"
790 "Use command-line to obtain credentials not explicitly set." },
791 { "parse_string", py_creds_parse_string, METH_VARARGS,
792 "S.parse_string(text[, credentials.SPECIFIED]) -> None\n"
793 "Parse credentials string." },
794 { "parse_file", py_creds_parse_file, METH_VARARGS,
795 "S.parse_file(filename[, credentials.SPECIFIED]) -> None\n"
796 "Parse credentials file." },
797 { "set_password_will_be_nt_hash",
798 py_cli_credentials_set_password_will_be_nt_hash, METH_VARARGS,
799 "S.set_password_will_be_nt_hash(bool) -> None\n"
800 "Alters the behaviour of S.set_password() "
801 "to expect the NTHASH as hexstring." },
802 { "get_nt_hash", py_creds_get_nt_hash, METH_NOARGS,
804 { "get_kerberos_state", py_creds_get_kerberos_state, METH_NOARGS,
806 { "set_kerberos_state", py_creds_set_kerberos_state, METH_VARARGS,
808 { "set_krb_forwardable", py_creds_set_krb_forwardable, METH_VARARGS,
810 { "guess", py_creds_guess, METH_VARARGS, NULL },
811 { "set_machine_account", py_creds_set_machine_account, METH_VARARGS, NULL },
812 { "get_named_ccache", py_creds_get_named_ccache, METH_VARARGS, NULL },
813 { "set_named_ccache", py_creds_set_named_ccache, METH_VARARGS,
814 "S.set_named_ccache(krb5_ccache_name, obtained, lp) -> None\n"
815 "Set credentials to KRB5 Credentials Cache (by name)." },
816 { "set_gensec_features", py_creds_set_gensec_features, METH_VARARGS, NULL },
817 { "get_gensec_features", py_creds_get_gensec_features, METH_NOARGS, NULL },
818 { "get_forced_sasl_mech", py_creds_get_forced_sasl_mech, METH_NOARGS,
819 "S.get_forced_sasl_mech() -> SASL mechanism\nObtain forced SASL mechanism." },
820 { "set_forced_sasl_mech", py_creds_set_forced_sasl_mech, METH_VARARGS,
821 "S.set_forced_sasl_mech(name) -> None\n"
822 "Set forced SASL mechanism." },
823 { "new_client_authenticator",
824 py_creds_new_client_authenticator,
826 "S.new_client_authenticator() -> Authenticator\n"
827 "Get a new client NETLOGON_AUTHENTICATOR"},
828 { "set_secure_channel_type", py_creds_set_secure_channel_type,
829 METH_VARARGS, NULL },
830 { "get_secure_channel_type", py_creds_get_secure_channel_type,
832 { "encrypt_netr_crypt_password",
833 py_creds_encrypt_netr_crypt_password,
835 "S.encrypt_netr_crypt_password(password) -> NTSTATUS\n"
836 "Encrypt the supplied password using the session key and\n"
837 "the negotiated encryption algorithm in place\n"
838 "i.e. it overwrites the original data"},
842 static struct PyModuleDef moduledef = {
843 PyModuleDef_HEAD_INIT,
844 .m_name = "credentials",
845 .m_doc = "Credentials management.",
847 .m_methods = py_creds_methods,
850 PyTypeObject PyCredentials = {
851 .tp_name = "credentials.Credentials",
852 .tp_new = py_creds_new,
853 .tp_flags = Py_TPFLAGS_DEFAULT,
854 .tp_methods = py_creds_methods,
857 static PyObject *py_ccache_name(PyObject *self, PyObject *unused)
859 struct ccache_container *ccc = NULL;
861 PyObject *py_name = NULL;
864 ccc = pytalloc_get_type(self, struct ccache_container);
866 ret = krb5_cc_get_full_name(ccc->smb_krb5_context->krb5_context,
869 py_name = PyString_FromStringOrNULL(name);
872 PyErr_SetString(PyExc_RuntimeError,
873 "Failed to get ccache name");
879 static PyMethodDef py_ccache_container_methods[] = {
880 { "get_name", py_ccache_name, METH_NOARGS,
881 "S.get_name() -> name\nObtain KRB5 credentials cache name." },
885 PyTypeObject PyCredentialCacheContainer = {
886 .tp_name = "credentials.CredentialCacheContainer",
887 .tp_flags = Py_TPFLAGS_DEFAULT,
888 .tp_methods = py_ccache_container_methods,
891 MODULE_INIT_FUNC(credentials)
894 if (pytalloc_BaseObject_PyType_Ready(&PyCredentials) < 0)
897 if (pytalloc_BaseObject_PyType_Ready(&PyCredentialCacheContainer) < 0)
900 m = PyModule_Create(&moduledef);
904 PyModule_AddObject(m, "UNINITIALISED", PyInt_FromLong(CRED_UNINITIALISED));
905 PyModule_AddObject(m, "CALLBACK", PyInt_FromLong(CRED_CALLBACK));
906 PyModule_AddObject(m, "GUESS_ENV", PyInt_FromLong(CRED_GUESS_ENV));
907 PyModule_AddObject(m, "GUESS_FILE", PyInt_FromLong(CRED_GUESS_FILE));
908 PyModule_AddObject(m, "CALLBACK_RESULT", PyInt_FromLong(CRED_CALLBACK_RESULT));
909 PyModule_AddObject(m, "SPECIFIED", PyInt_FromLong(CRED_SPECIFIED));
911 PyModule_AddObject(m, "AUTO_USE_KERBEROS", PyInt_FromLong(CRED_AUTO_USE_KERBEROS));
912 PyModule_AddObject(m, "DONT_USE_KERBEROS", PyInt_FromLong(CRED_DONT_USE_KERBEROS));
913 PyModule_AddObject(m, "MUST_USE_KERBEROS", PyInt_FromLong(CRED_MUST_USE_KERBEROS));
915 PyModule_AddObject(m, "AUTO_KRB_FORWARDABLE", PyInt_FromLong(CRED_AUTO_KRB_FORWARDABLE));
916 PyModule_AddObject(m, "NO_KRB_FORWARDABLE", PyInt_FromLong(CRED_NO_KRB_FORWARDABLE));
917 PyModule_AddObject(m, "FORCE_KRB_FORWARDABLE", PyInt_FromLong(CRED_FORCE_KRB_FORWARDABLE));
918 PyModule_AddObject(m, "CLI_CRED_NTLM2", PyInt_FromLong(CLI_CRED_NTLM2));
919 PyModule_AddObject(m, "CLI_CRED_NTLMv2_AUTH", PyInt_FromLong(CLI_CRED_NTLMv2_AUTH));
920 PyModule_AddObject(m, "CLI_CRED_LANMAN_AUTH", PyInt_FromLong(CLI_CRED_LANMAN_AUTH));
921 PyModule_AddObject(m, "CLI_CRED_NTLM_AUTH", PyInt_FromLong(CLI_CRED_NTLM_AUTH));
922 PyModule_AddObject(m, "CLI_CRED_CLEAR_AUTH", PyInt_FromLong(CLI_CRED_CLEAR_AUTH));
924 Py_INCREF(&PyCredentials);
925 PyModule_AddObject(m, "Credentials", (PyObject *)&PyCredentials);
926 Py_INCREF(&PyCredentialCacheContainer);
927 PyModule_AddObject(m, "CredentialCacheContainer", (PyObject *)&PyCredentialCacheContainer);