Package: python-tss-sdk
The Delinea Secret Server Python SDKTheDelineaSecret ServerPython SDK contains classes that interact with Secret Server via the REST API.Installpython-mpipinstallpython-tss-sdkSecret Server AuthenticationThere are three ways in which you can authorize theSecretServerandSecretServerCloudclasses to fetch secrets.Password Authorization (withPasswordGrantAuthorizer)Domain Authorization (withDomainPasswordGrantAuthorizer)Access Token Authorization (withAccessTokenAuthorizer)UsagePassword AuthorizationIf using traditionalusernameandpasswordauthentication to log in to your Secret Server, you can pass thePasswordGrantAuthorizerinto theSecretServerclass at instantiation. ThePasswordGrantAuthorizerrequires abase_url,username, andpassword. It optionally takes atoken_path_uri, but defaults to/oauth2/token.fromdelinea.secrets.serverimportPasswordGrantAuthorizerauthorizer=PasswordGrantAuthorizer("https://hostname/SecretServer",os.getenv("myusername"),os.getenv("password")")Domain AuthorizationTo use a domain credential, use theDomainPasswordGrantAuthorizer. It requires abase_url,username,domain, andpassword. It optionally takes atoken_path_uri, but defaults to/oauth2/token.fromdelinea.secrets.serverimportDomainPasswordGrantAuthorizerauthorizer=DomainPasswordGrantAuthorizer("https://hostname/SecretServer",os.getenv("myusername"),os.getenv("mydomain"),os.getenv("password"))Access Token AuthorizationIf you already have anaccess_token, you can pass directly via theAccessTokenAuthorizer.fromdelinea.secrets.serverimportAccessTokenAuthorizerauthorizer=AccessTokenAuthorizer("AgJ1slfZsEng9bKsssB-tic0Kh8I...")Secret Server CloudThe SDK API requires anAuthorizerand atenant.tenantsimplifies the configuration when using Secret Server Cloud by assuming the default folder structure and creating thebase URLfrom a template that takes thetenantand an optional top-level domain (TLD) that defaults tocom, as parameters.UseageInstantiate theSecretServerCloudclass withtenantand anAuthorizer(optionally include atld). To retrieve a secret, pass an integeridtoget_secret()which will return the secret as a JSON encoded string.fromdelinea.secrets.serverimportSecretServerCloudsecret_server=SecretServerCloud("mytenant",authorizer)secret=secret_server.get_secret(1)The SDK API also contains aSecret@dataclasscontaining a subset of the Secret's attributes and a dictionary of all the fields keyed by the Secret'sslug.Initializing SecretServerUseageNOTE: In v1.0.0SecretServerreplacesSecretServerV1. However,SecretServerV0is available to use instead, for backwards compatibility with v0.0.5 and v0.0.6.To instantiate theSecretServerclass, it requires abase_url, anAuthorizerobject (see above), and an optionalapi_path_uri(defaults to"/api/v1")fromdelinea.secrets.serverimportSecretServersecret_server=SecretServer("https://hostname/SecretServer",my_authorizer)Secrets can be fetched using theget_secretmethod, which takes an integeridof the secret and, returns ajsonobject:secret=secret_server.get_secret(1)print(f"username:{secret.fields['username'].value}\npassword:{secret.fields['password'].value}")Alternatively, you can use pass the json toServerSecretwhich returns adataclassobject representation of the secret:fromdelinea.secrets.serverimportServerSecretsecret=ServerSecret(**secret_server.get_secret(1))username=secret.fields['username'].valueIt is also now possible to fetch a secret by the secretspathusing theget_secret_by_pathmethod on theSecretServerobject. This, too, returns ajsonobject.secret=secret_server.get_secret_by_path(r"\FolderPath\Secret Name")print(f"username:{secret.fields['username'].value}\npassword:{secret.fields['password'].value}")Note: Thepathmust be the full folder path and name of the secret.Using Self-Signed CertificatesWhen using a self-signed certificate for SSL, theREQUESTS_CA_BUNDLEenvironment variable should be set to the path of the certificate (in.pemformat). This will negate the need to ignore SSL certificate verification, which makes your application vunerable. Please reference therequestsdocumentationfor further details on theREQUESTS_CA_BUNDLEenvironment variable, should you require it.Create a Build Environment (optional)The SDK requiresPython 3.8or higher.First, ensure Python is in$PATH, then run:# Clone the repogitclonehttps://github.com/DelineaXPM/python-tss-sdkcdpython-tss-sdk# Create a virtual environmentpython-mvenvvenv
.venv/bin/activate# Install dependenciespython-mpipinstall--upgradepip
pipinstall-rrequirements.txtValid credentials are required to run the unit tests. The credentials should be stored in environment variables or in a.envfile:exportTSS_USERNAME=myusernameexportTSS_PASSWORD=mysecretpasswordexportTSS_TENANT=mytenantexportTSS_SECRET_ID=42exportTSS_SECRET_PATH=\TestSecrets\SecretNameexportTSS_FOLDER_ID=1The tests assume that the user associated with the specifiedTSS_USERNAMEandTSS_PASSWORDcan read the secret to be fetched, and that the Secret itself containsusernameandpasswordfields.To run the tests withtox:toxTo build the package, useFlit:flitbuild