Use the correct GSSAPI nametype (hostbased_service)

Signed-off-by: Robbie Harwood <[email protected]>

Author: frozencemetery

README.rst

@@ -133,7 +133,8 @@ applicable). However, an explicit credential can be in instead, if desired.
     >>> import gssapi
     >>> import requests
     >>> from requests_gssapi import HTTPSPNEGOAuth, REQUIRED
-    >>> creds = gssapi.Credentials(name=gssapi.Name("user@REALM"), usage="initiate")
+    >>> name = gssapi.Name("user@REALM", gssapi.NameType.hostbased_service)
+    >>> creds = gssapi.Credentials(name=name, usage="initiate")
     >>> gssapi_auth = HTTPSPNEGOAuth(creds=creds)
     >>> r = requests.get("http://example.org", auth=gssapi_auth)
     ...

requests_gssapi/compat.py

@@ -45,7 +45,8 @@ def generate_request_header(self, response, host, is_preemptive=False):
         try:
             if self.principal is not None:
                 gss_stage = "acquiring credentials"
-                name = gssapi.Name(self.principal)
+                name = gssapi.Name(
+                    self.principal, gssapi.NameType.hostbased_service)
                 self.creds = gssapi.Credentials(name=name, usage="initiate")
 
             # contexts still need to be stored by host, but hostname_override
@@ -59,7 +60,8 @@ def generate_request_header(self, response, host, is_preemptive=False):
                     kerb_host = self.hostname_override
 
                 kerb_spn = "{0}@{1}".format(self.service, kerb_host)
-                self.target_name = gssapi.Name(kerb_spn)
+                self.target_name = gssapi.Name(
+                    kerb_spn, gssapi.NameType.hostbased_service)
 
             return HTTPSPNEGOAuth.generate_request_header(self, response,
                                                           host, is_preemptive)

requests_gssapi/gssapi_.py

@@ -134,7 +134,8 @@ def generate_request_header(self, response, host, is_preemptive=False):
                 if '@' not in self.target_name:
                     self.target_name = "%s@%s" % (self.target_name, host)
 
-                self.target_name = gssapi.Name(self.target_name)
+                self.target_name = gssapi.Name(
+                    self.target_name, gssapi.NameType.hostbased_service)
             self.context[host] = gssapi.SecurityContext(
                 usage="initiate", flags=gssflags, name=self.target_name,
                 creds=self.creds)

test_requests_gssapi.py

@@ -37,6 +37,10 @@
 b64_negotiate_server = "negotiate " + b64encode(b"servertoken").decode()
 
 
+def gssapi_name(s):
+    return gssapi.Name(s, gssapi.NameType.hostbased_service)
+
+
 class GSSAPITestCase(unittest.TestCase):
     def setUp(self):
         """Setup."""
@@ -99,7 +103,7 @@ def test_generate_request_header(self):
                 auth.generate_request_header(response, host),
                 b64_negotiate_response)
             fake_init.assert_called_with(
-                name=gssapi.Name("[email protected]"),
+                name=gssapi_name("[email protected]"),
                 creds=None, flags=gssflags, usage="initiate")
             fake_resp.assert_called_with(b"token")
 
@@ -114,7 +118,7 @@ def test_generate_request_header_init_error(self):
             self.assertRaises(requests_gssapi.exceptions.SPNEGOExchangeError,
                               auth.generate_request_header, response, host)
             fake_init.assert_called_with(
-                name=gssapi.Name("[email protected]"),
+                name=gssapi_name("[email protected]"),
                 usage="initiate", flags=gssflags, creds=None)
 
     def test_generate_request_header_step_error(self):
@@ -128,7 +132,7 @@ def test_generate_request_header_step_error(self):
             self.assertRaises(requests_gssapi.exceptions.SPNEGOExchangeError,
                               auth.generate_request_header, response, host)
             fake_init.assert_called_with(
-                name=gssapi.Name("[email protected]"),
+                name=gssapi_name("[email protected]"),
                 usage="initiate", flags=gssflags, creds=None)
             fail_resp.assert_called_with(b"token")
 
@@ -165,7 +169,7 @@ def test_authenticate_user(self):
             connection.send.assert_called_with(request)
             raw.release_conn.assert_called_with()
             fake_init.assert_called_with(
-                name=gssapi.Name("[email protected]"),
+                name=gssapi_name("[email protected]"),
                 flags=gssflags, usage="initiate", creds=None)
             fake_resp.assert_called_with(b"token")
 
@@ -202,7 +206,7 @@ def test_handle_401(self):
             connection.send.assert_called_with(request)
             raw.release_conn.assert_called_with()
             fake_init.assert_called_with(
-                name=gssapi.Name("[email protected]"),
+                name=gssapi_name("[email protected]"),
                 creds=None, flags=gssflags, usage="initiate")
             fake_resp.assert_called_with(b"token")
 
@@ -436,7 +440,7 @@ def test_handle_response_401(self):
             connection.send.assert_called_with(request)
             raw.release_conn.assert_called_with()
             fake_init.assert_called_with(
-                name=gssapi.Name("[email protected]"),
+                name=gssapi_name("[email protected]"),
                 usage="initiate", flags=gssflags, creds=None)
             fake_resp.assert_called_with(b"token")
 
@@ -479,7 +483,7 @@ def connection_send(self, *args, **kwargs):
             connection.send.assert_called_with(request)
             raw.release_conn.assert_called_with()
             fake_init.assert_called_with(
-                name=gssapi.Name("[email protected]"),
+                name=gssapi_name("[email protected]"),
                 usage="initiate", flags=gssflags, creds=None)
             fake_resp.assert_called_with(b"token")
 
@@ -493,7 +497,7 @@ def test_generate_request_header_custom_service(self):
             auth = requests_gssapi.HTTPKerberosAuth(service="barfoo")
             auth.generate_request_header(response, host),
             fake_init.assert_called_with(
-                name=gssapi.Name("[email protected]"),
+                name=gssapi_name("[email protected]"),
                 usage="initiate", flags=gssflags, creds=None)
             fake_resp.assert_called_with(b"token")
 
@@ -530,7 +534,7 @@ def test_delegation(self):
             connection.send.assert_called_with(request)
             raw.release_conn.assert_called_with()
             fake_init.assert_called_with(
-                name=gssapi.Name("[email protected]"),
+                name=gssapi_name("[email protected]"),
                 usage="initiate", flags=gssdelegflags, creds=None)
             fake_resp.assert_called_with(b"token")
 
@@ -546,11 +550,10 @@ def test_principal_override(self):
             auth.generate_request_header(response, host)
             fake_creds.assert_called_with(gssapi.creds.Credentials,
                                           usage="initiate",
-                                          name=gssapi.Name("user@REALM"))
+                                          name=gssapi_name("user@REALM"))
             fake_init.assert_called_with(
-                name=gssapi.Name("[email protected]"),
+                name=gssapi_name("[email protected]"),
                 usage="initiate", flags=gssflags, creds=b"fake creds")
-            fake_resp.assert_called_with(b"token")
 
     def test_realm_override(self):
         with patch.multiple("gssapi.SecurityContext", __init__=fake_init,
@@ -563,7 +566,7 @@ def test_realm_override(self):
                 hostname_override="otherhost.otherdomain.org")
             auth.generate_request_header(response, host)
             fake_init.assert_called_with(
-                name=gssapi.Name("[email protected]"),
+                name=gssapi_name("[email protected]"),
                 usage="initiate", flags=gssflags, creds=None)
             fake_resp.assert_called_with(b"token")
 
@@ -592,7 +595,7 @@ def test_explicit_creds(self):
             auth = requests_gssapi.HTTPSPNEGOAuth(creds=creds)
             auth.generate_request_header(response, host)
             fake_init.assert_called_with(
-                name=gssapi.Name("[email protected]"),
+                name=gssapi_name("[email protected]"),
                 usage="initiate", flags=gssflags, creds=b"fake creds")
             fake_resp.assert_called_with(b"token")
 
@@ -607,7 +610,7 @@ def test_target_name(self):
                 target_name="[email protected]")
             auth.generate_request_header(response, host)
             fake_init.assert_called_with(
-                name=gssapi.Name("[email protected]"),
+                name=gssapi_name("[email protected]"),
                 usage="initiate", flags=gssflags, creds=None)
             fake_resp.assert_called_with(b"token")