#NEWLINE# def create_token( self , response ) : #NEWLINE# #INDENT# '\n        This method verifies that the response given from the client\n        is valid and if so returns a token used for authentication.\n        ' #NEWLINE# s = ssh . base64url_decode ( response ) #NEWLINE# if ( s [ 0 ] == 'r' ) : #NEWLINE# #INDENT# version_1 = False #NEWLINE# if ( self . lowest_supported_version > 0 ) : #NEWLINE# #INDENT# raise exceptions . ProtocolVersionError ( ( 'Client needs to support at least version %d' % self . lowest_supported_version ) ) #NEWLINE# #UNINDENT# r = protocol . Response . deserialize ( s ) #NEWLINE# if ( not r . hmac_challenge . verify ( self . _hmac ) ) : #NEWLINE# #INDENT# raise exceptions . InvalidInputException ( 'Challenge hmac verification failed, not matching  secret' ) #NEWLINE# #UNINDENT# challenge = protocol . Challenge . deserialize ( r . hmac_challenge . payload ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( s [ 0 ] == '\x01' ) : #NEWLINE# #INDENT# version_1 = True #NEWLINE# r = msgpack_protocol . Response . deserialize ( s ) #NEWLINE# challenge = msgpack_protocol . Challenge . deserialize_authenticated ( r . challenge , self . secret ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# raise exceptions . ProtocolError ( 'invalid first byte of response' ) #NEWLINE# #UNINDENT# #UNINDENT# if ( self . server_name != challenge . server_name ) : #NEWLINE# #INDENT# s = 'Got challenge with the wrong server_name encoded' #NEWLINE# raise exceptions . InvalidInputException ( s ) #NEWLINE# #UNINDENT# key = self . key_provider . get_key ( challenge . username ) #NEWLINE# if ( challenge . valid_from > self . now_func ( ) ) : #NEWLINE# #INDENT# s = time . strftime ( '%Y-%m-%d %H:%M:%S UTC' , time . gmtime ( challenge . valid_from ) ) #NEWLINE# raise exceptions . InvalidInputException ( ( 'Response with challenge created as %s too new ' % s ) ) #NEWLINE# #UNINDENT# if ( challenge . valid_to < self . now_func ( ) ) : #NEWLINE# #INDENT# s = time . strftime ( '%Y-%m-%d %H:%M:%S UTC' , time . gmtime ( challenge . valid_from ) ) #NEWLINE# raise exceptions . InvalidInputException ( ( 'Response with challenge created as %s too old ' % s ) ) #NEWLINE# #UNINDENT# if version_1 : #NEWLINE# #INDENT# if ( not key . verify_signature ( r . signature , r . challenge ) ) : #NEWLINE# #INDENT# raise exceptions . InvalidInputException ( 'Client did not provide proof that it controls the secret key' ) #NEWLINE# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# if ( not key . verify_signature ( r . signature , r . hmac_challenge . payload ) ) : #NEWLINE# #INDENT# raise exceptions . InvalidInputException ( 'Client did not provide proof that it controls the secret key' ) #NEWLINE# #UNINDENT# #UNINDENT# expire_time = ( int ( self . now_func ( ) ) + self . token_lifetime ) #NEWLINE# return self . _make_token ( challenge . username , expire_time )