Package: python-cern-sso-krb
This is a re-implementation of the Perl scriptcern-get-sso-cookie_.as a Python library. As a bonus, a shell client re-implementing (mostof) the functionality of ``cern-get-sso-cookie``, is also provided... _cern-get-sso-cookie: https://github.com/sashabaranov/cern-get-sso-cookie/Prerequisites-------------This package assumes a working Kerberos and OpenSSL setup, but should becompatible with both python 2.7 and 3.Usage-----The module provides only two functions: ``krb_sign_on`` and``cert_sign_on``, used for authentication with Kerberos and certificatesrespectively. Both take an optional cookiejar (which can be a Requests``CookieJar``, or a ``MozillaCookieJar``) which is filled duringoperations. In any event, a cookie jar is also returned by bothfunctions.The returned cookie jar can be used directly as an argument to Requests'``cookies``.. code:: pythonimport cern_ssoimport requestsmy_url = "https://my-secret-place.cern.ch"cookies = cern_sso.krb_sign_on(my_url)# Perform requestr1 = requests.get(my_url, cookies=cookies)It is assumed that the user running the program is already authenticatedagainst Kerberos.This is what the same procedure would look like using SSL certificates:.. code:: pythonimport cern_ssoimport requestsmy_url = "https://my-secret-place.cern.ch"cert_file = "/home/albin/myCert.pem"key_file = "/home/albin/myCert.key"cookies = cern_sso.cert_sign_on(my_url, cert_file=cert_file,key_file=key_file)# Perform requestr1 = requests.get(my_url, cookies=cookies)Certain limitations apply to the certificate and key files, please seethe following section on command-line usage for further information onthis.For an example of how to use an external CookieJar, see``bin/cern-get-sso-cookie.py``.Using ``cern-get-sso-cookie.py``------------------------------Just like ``cern-get-sso-cookie``, the Python implementation willauthenticate against a desired URL and returna Mozilla cookie-filesuitable for use with Curl or Wget.For use with Kerberos, make sure you are authenticated either viapassword or a keytab:.. code:: sh$ kinit me@CERN.CH<enter password>Now you can perform the authentication:.. code:: sh$ cern-get-sso-cookie.py --url https://cerntraining.service-now.com --kerberos# cookies.txt now contains the relevant session cookies$ curl -L --cookie cookies.txt --cookie-jar cookies.txt -H 'Accept: application/json' "https://cerntraining.service-now.com/api/now/v1/table/incident"In the spirit of the UNIX philosophy, ``cern-get-sso-cookie.py`` outputsnothing on success. Please try ``--verbose`` or even ``--debug`` if that isnot to your liking!For authentication against a SSL certificate (and key), you first needto process the certificate files to remove passwords and separate thekey and certificate:.. code:: sh$ openssl pkcs12 -clcerts -nokeys -in myCert.p12 -out myCert.pem$ openssl pkcs12 -nocerts -in myCert.p12 -out myCert.tmp.key$ openssl rsa -in myCert.tmp.key -out myCert.keyIt is assumed that your certificate and key files have the same basename and are located in the same folder, and that the key has the fileending ``.key`` and the certificate ``.pem``. In the example above, the basename ``myCert`` was used.Finally, you can use the certificates to obtain a SSO cookie:.. code:: sh$ cern-get-sso-cookie.py --url https://cerntraining.service-now.com --cert myCertFor further notes on usage, see ``cern-get-sso-cookie.py --help``.