Skip to content

Commit 6aa78d6

Browse files
frozencemeteryfrozencemetery
committed
Use USER_NAME instead of HOSTBASED_SERVICE for user principals
Probably this was me making an assumption based on seeing "name" in the start of a connection and assuming it was the server name. Bad naming - there's "name" and "target_name" around.
1 parent 65690d1 commit 6aa78d6

File tree

2 files changed

+21
-17
lines changed

2 files changed

+21
-17
lines changed

‎requests_gssapi/compat.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ def generate_request_header(self, response, host, is_preemptive=False):
4646
if self.principal is not None:
4747
gss_stage = "acquiring credentials"
4848
name = gssapi.Name(
49-
self.principal, gssapi.NameType.hostbased_service)
49+
self.principal, gssapi.NameType.user)
5050
self.creds = gssapi.Credentials(name=name, usage="initiate")
5151

5252
# contexts still need to be stored by host, but hostname_override

‎test_requests_gssapi.py‎

Lines changed: 20 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,14 @@
3939
b64_negotiate_server = "negotiate " + b64encode(b"servertoken").decode()
4040

4141

42-
def gssapi_name(s):
42+
def gssapi_sname(s):
4343
return gssapi.Name(s, gssapi.NameType.hostbased_service)
4444

4545

46+
def gssapi_uname(s):
47+
return gssapi.Name(s, gssapi.NameType.user)
48+
49+
4650
class GSSAPITestCase(unittest.TestCase):
4751
def setUp(self):
4852
"""Setup."""
@@ -105,7 +109,7 @@ def test_generate_request_header(self):
105109
auth.generate_request_header(response, host),
106110
b64_negotiate_response)
107111
fake_init.assert_called_with(
108-
name=gssapi_name("HTTP@www.example.org"),
112+
name=gssapi_sname("HTTP@www.example.org"),
109113
creds=None, mech=None, flags=gssflags, usage="initiate")
110114
fake_resp.assert_called_with(b"token")
111115

@@ -120,7 +124,7 @@ def test_generate_request_header_init_error(self):
120124
self.assertRaises(requests_gssapi.exceptions.SPNEGOExchangeError,
121125
auth.generate_request_header, response, host)
122126
fake_init.assert_called_with(
123-
name=gssapi_name("HTTP@www.example.org"),
127+
name=gssapi_sname("HTTP@www.example.org"),
124128
usage="initiate", flags=gssflags, creds=None, mech=None)
125129

126130
def test_generate_request_header_step_error(self):
@@ -134,7 +138,7 @@ def test_generate_request_header_step_error(self):
134138
self.assertRaises(requests_gssapi.exceptions.SPNEGOExchangeError,
135139
auth.generate_request_header, response, host)
136140
fake_init.assert_called_with(
137-
name=gssapi_name("HTTP@www.example.org"),
141+
name=gssapi_sname("HTTP@www.example.org"),
138142
usage="initiate", flags=gssflags, creds=None, mech=None)
139143
fail_resp.assert_called_with(b"token")
140144

@@ -171,7 +175,7 @@ def test_authenticate_user(self):
171175
connection.send.assert_called_with(request)
172176
raw.release_conn.assert_called_with()
173177
fake_init.assert_called_with(
174-
name=gssapi_name("HTTP@www.example.org"),
178+
name=gssapi_sname("HTTP@www.example.org"),
175179
flags=gssflags, usage="initiate", creds=None, mech=None)
176180
fake_resp.assert_called_with(b"token")
177181

@@ -208,7 +212,7 @@ def test_handle_401(self):
208212
connection.send.assert_called_with(request)
209213
raw.release_conn.assert_called_with()
210214
fake_init.assert_called_with(
211-
name=gssapi_name("HTTP@www.example.org"),
215+
name=gssapi_sname("HTTP@www.example.org"),
212216
creds=None, mech=None, flags=gssflags, usage="initiate")
213217
fake_resp.assert_called_with(b"token")
214218

@@ -447,7 +451,7 @@ def test_handle_response_401(self):
447451
connection.send.assert_called_with(request)
448452
raw.release_conn.assert_called_with()
449453
fake_init.assert_called_with(
450-
name=gssapi_name("HTTP@www.example.org"),
454+
name=gssapi_sname("HTTP@www.example.org"),
451455
usage="initiate", flags=gssflags, creds=None, mech=None)
452456
fake_resp.assert_called_with(b"token")
453457

@@ -490,7 +494,7 @@ def connection_send(self, *args, **kwargs):
490494
connection.send.assert_called_with(request)
491495
raw.release_conn.assert_called_with()
492496
fake_init.assert_called_with(
493-
name=gssapi_name("HTTP@www.example.org"),
497+
name=gssapi_sname("HTTP@www.example.org"),
494498
usage="initiate", flags=gssflags, creds=None, mech=None)
495499
fake_resp.assert_called_with(b"token")
496500

@@ -504,7 +508,7 @@ def test_generate_request_header_custom_service(self):
504508
auth = requests_gssapi.HTTPKerberosAuth(service="barfoo")
505509
auth.generate_request_header(response, host),
506510
fake_init.assert_called_with(
507-
name=gssapi_name("barfoo@www.example.org"),
511+
name=gssapi_sname("barfoo@www.example.org"),
508512
usage="initiate", flags=gssflags, creds=None, mech=None)
509513
fake_resp.assert_called_with(b"token")
510514

@@ -542,7 +546,7 @@ def test_delegation(self):
542546
connection.send.assert_called_with(request)
543547
raw.release_conn.assert_called_with()
544548
fake_init.assert_called_with(
545-
name=gssapi_name("HTTP@www.example.org"),
549+
name=gssapi_sname("HTTP@www.example.org"),
546550
usage="initiate", flags=gssdelegflags, creds=None, mech=None)
547551
fake_resp.assert_called_with(b"token")
548552

@@ -558,9 +562,9 @@ def test_principal_override(self):
558562
auth.generate_request_header(response, host)
559563
fake_creds.assert_called_with(gssapi.creds.Credentials,
560564
usage="initiate",
561-
name=gssapi_name("user@REALM"))
565+
name=gssapi_uname("user@REALM", ))
562566
fake_init.assert_called_with(
563-
name=gssapi_name("HTTP@www.example.org"),
567+
name=gssapi_sname("HTTP@www.example.org"),
564568
usage="initiate", flags=gssflags,
565569
creds=b"fake creds", mech=None)
566570

@@ -575,7 +579,7 @@ def test_realm_override(self):
575579
hostname_override="otherhost.otherdomain.org")
576580
auth.generate_request_header(response, host)
577581
fake_init.assert_called_with(
578-
name=gssapi_name("HTTP@otherhost.otherdomain.org"),
582+
name=gssapi_sname("HTTP@otherhost.otherdomain.org"),
579583
usage="initiate", flags=gssflags, creds=None, mech=None)
580584
fake_resp.assert_called_with(b"token")
581585

@@ -604,7 +608,7 @@ def test_explicit_creds(self):
604608
auth = requests_gssapi.HTTPSPNEGOAuth(creds=creds)
605609
auth.generate_request_header(response, host)
606610
fake_init.assert_called_with(
607-
name=gssapi_name("HTTP@www.example.org"),
611+
name=gssapi_sname("HTTP@www.example.org"),
608612
usage="initiate", flags=gssflags,
609613
creds=b"fake creds", mech=None)
610614
fake_resp.assert_called_with(b"token")
@@ -621,7 +625,7 @@ def test_explicit_mech(self):
621625
auth = requests_gssapi.HTTPSPNEGOAuth(mech=fake_mech)
622626
auth.generate_request_header(response, host)
623627
fake_init.assert_called_with(
624-
name=gssapi_name("HTTP@www.example.org"),
628+
name=gssapi_sname("HTTP@www.example.org"),
625629
usage="initiate", flags=gssflags,
626630
creds=None, mech=b'fake mech')
627631
fake_resp.assert_called_with(b"token")
@@ -637,7 +641,7 @@ def test_target_name(self):
637641
target_name="HTTP@otherhost.otherdomain.org")
638642
auth.generate_request_header(response, host)
639643
fake_init.assert_called_with(
640-
name=gssapi_name("HTTP@otherhost.otherdomain.org"),
644+
name=gssapi_sname("HTTP@otherhost.otherdomain.org"),
641645
usage="initiate", flags=gssflags, creds=None, mech=None)
642646
fake_resp.assert_called_with(b"token")
643647

0 commit comments

Comments
 (0)