ark-sdk-python 1.0.4__py3-none-any.whl → 1.0.6__py3-none-any.whl

ark_sdk_python/actions/ark_login_action.py

@@ -16,6 +16,7 @@ from ark_sdk_python.models.auth import (
     ArkAuthMethodsRequireCredentials,
     ArkSecret,
     ArkToken,
+    IdentityArkAuthMethodSettings,
 )
 
 
@@ -138,7 +139,19 @@ class ArkLoginAction(ArkAction):
                         if (
                             authenticator_name == 'isp'
                             and auth_profile.auth_method == ArkAuthMethod.Identity
-                            and ArkIdentity.is_idp_user(auth_profile.username)
+                            and ArkIdentity.is_idp_user(
+                                auth_profile.username,
+                                (
+                                    auth_profile.auth_method_settings.identity_url
+                                    if isinstance(auth_profile.auth_method_settings, IdentityArkAuthMethodSettings)
+                                    else None
+                                ),
+                                (
+                                    auth_profile.auth_method_settings.identity_tenant_subdomain
+                                    if isinstance(auth_profile.auth_method_settings, IdentityArkAuthMethodSettings)
+                                    else None
+                                ),
+                            )
                         ):
                             secret = ArkSecret(secret='')
                         else:

ark_sdk_python/ark.py

@@ -17,7 +17,7 @@ from ark_sdk_python.actions import ArkAction, ArkCacheAction, ArkConfigureAction
 
 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
-__version__ = '1.0.4'
+__version__ = '1.0.6'
 
 
 def main():

ark_sdk_python/auth/ark_isp_auth.py

@@ -46,6 +46,7 @@ class ArkISPAuth(ArkAuth):
                 username=auth_profile.username,
                 password=secret.secret.get_secret_value() if secret else None,
                 identity_url=method_settings.identity_url,
+                identity_tenant_subdomain=method_settings.identity_tenant_subdomain,
                 mfa_type=method_settings.identity_mfa_method,
                 logger=self._logger,
                 cache_authentication=self._cache_authentication,

ark_sdk_python/auth/identity/ark_identity.py

@@ -1,6 +1,7 @@
 import codecs
 import json
 import logging
+import os
 import re
 import sys
 import time
@@ -19,6 +20,7 @@ from requests import Session
 from ark_sdk_python.args import ArkArgsFormatter, ArkInquirerRender
 from ark_sdk_python.auth.identity.ark_identity_fqdn_resolver import ArkIdentityFQDNResolver
 from ark_sdk_python.common import ArkKeyring, ArkSystemConfig, get_logger
+from ark_sdk_python.common.env import AwsEnv
 from ark_sdk_python.models import ArkException, ArkNonInteractiveException
 from ark_sdk_python.models.ark_exceptions import ArkAuthException
 from ark_sdk_python.models.ark_profile import ArkProfile
@@ -75,6 +77,7 @@ class ArkIdentity:
         username: str,
         password: Optional[str],
         identity_url: Optional[str] = None,
+        identity_tenant_subdomain: Optional[str] = None,
         mfa_type: Optional[str] = None,
         logger: Optional[logging.Logger] = None,
         cache_authentication: bool = True,
@@ -84,7 +87,7 @@ class ArkIdentity:
     ) -> None:
         self.__username = username
         self.__password = password
-        self.__identity_url = identity_url or self.__resolve_fqdn_from_username()
+        self.__identity_url = self.__resolve_fqdn_from_username_or_subdomain(identity_url, identity_tenant_subdomain)
         if not self.__identity_url.startswith('https://'):
             self.__identity_url = f'https://{self.__identity_url}'
         self.__mfa_type = mfa_type
@@ -158,7 +161,16 @@ class ArkIdentity:
                 f'{self.__username}_identity_session',
             )
 
-    def __resolve_fqdn_from_username(self) -> str:
+    def __resolve_fqdn_from_username_or_subdomain(self, identity_url: Optional[str], identity_tenant_subdomain: Optional[str]) -> str:
+        if identity_tenant_subdomain and not identity_url:
+            try:
+                identity_url = ArkIdentityFQDNResolver.resolve_tenant_fqdn_from_tenant_subdomain(
+                    identity_tenant_subdomain, AwsEnv(os.environ.get('DEPLOY_ENV', AwsEnv.PROD.value))
+                )
+            except Exception as ex:
+                self.__logger.warning(f'Failed to resolve url from tenant subdomain, falling back to user [{str(ex)}]')
+        if identity_url:
+            return identity_url
         tenant_suffix = self.__username[self.__username.index('@') :]
         return ArkIdentityFQDNResolver.resolve_tenant_fqdn_from_tenant_suffix(tenant_suffix=tenant_suffix)
 
@@ -166,7 +178,7 @@ class ArkIdentity:
         self.__logger.info(f'Starting authentication with user {self.__username} and fqdn {self.__identity_url}')
         response = self.__session.post(
             url=f'{self.__identity_url}/Security/StartAuthentication',
-            json={'User': self.__username, 'Version': '1.0', 'PlatformTokenResponse': True},
+            json={'User': self.__username, 'Version': '1.0', 'PlatformTokenResponse': True, 'MfaRequestor': 'DeviceAgent'},
         )
         try:
             parsed_res: StartAuthResponse = StartAuthResponse.parse_raw(response.text)
@@ -381,19 +393,26 @@ class ArkIdentity:
 
     @classmethod
     @cached(cache=LRUCache(maxsize=1024))
-    def is_idp_user(cls, username: str) -> bool:
+    def is_idp_user(cls, username: str, identity_url: Optional[str], identity_tenant_subdomain: Optional[str]) -> bool:
         """
         Checks whether or not the specified username is from an external IDP.
 
         Args:
             username (str): _description_
+            identity_url (Optional[str]): _description_
+            identity_tenant_subdomain (Optional[str]): _description_
 
         Returns:
             bool: _description_
         """
         if re.match('.*@cyberark\\.cloud\\.(\\d)+', username) is not None:
             return False
-        identity = ArkIdentity(username=username, password='')
+        identity = ArkIdentity(
+            username=username,
+            password='',
+            identity_url=identity_url,
+            identity_tenant_subdomain=identity_tenant_subdomain,
+        )
         resp = identity.__start_authentication()
         return resp.result.idp_redirect_url != None
 

ark_sdk_python/models/actions/ark_configure_action_consts.py

@@ -31,6 +31,7 @@ CONFIGURATION_AUTHENTICATOR_IGNORED_INTERACTIVE_KEYS: Final[Dict[str, List[str]]
 }
 CONFIGURATION_ALLOWED_EMPTY_VALUES: Final[List[str]] = {
     'isp_identity_url',
+    'isp_identity_tenant_subdomain',
 }
 CONFIGURATION_AUTHENTICATORS_DEFAULTS: Final[Dict[str, str]] = {}
 CONFIGURATION_OVERRIDE_ALIASES: Final[Dict[str, str]] = {'region': 'Region', 'env': 'Environment'}

ark_sdk_python/models/auth/ark_auth_method.py

@@ -28,6 +28,12 @@ class IdentityArkAuthMethodSettings(ArkAuthMethodSettings):
     identity_url: Optional[str] = Field(
         description='Identity url to use for authentication instead of fqdn resolving', alias='Identity Url'
     )
+    identity_tenant_subdomain: Optional[str] = Field(
+        description='Identity security platform tenant subdomain, '
+        'for exmaple mytenant.cyberark.cloud would be subdomained to mytenant. '
+        'this will be used instead of fqdn resolving from the username',
+        alias='Identity Tenant Subdomain',
+    )
 
 
 class IdentityServiceUserArkAuthMethodSettings(ArkAuthMethodSettings):

ark_sdk_python/services/dpa/sso/ark_dpa_sso_service.py

@@ -66,9 +66,16 @@ class ArkDPASSOService(ArkService):
             postfix=f'{claims["tenant_id"]}_{claims["unique_name"]}_dpa_sso_short_lived_{token_type}',
         )
 
+    def __expand_folder(self, folder: str) -> str:
+        folder_path = os.path.expanduser(folder)
+        if not folder_path.endswith('/'):
+            folder_path += '/'
+        return folder_path
+
     def __output_client_certificate(
         self, folder: str, output_format: ArkDPASSOShortLiveClientCertificateFormat, result: ArkDPASSOAcquireTokenResponse
     ) -> None:
+        folder_path = self.__expand_folder(folder)
         claims = get_unverified_claims(self.__client.session_token)
         client_certificate = result.token['client_certificate']
         private_key = result.token['private_key']
@@ -82,24 +89,24 @@ class ArkDPASSOService(ArkService):
             )
             ArkArgsFormatter.print_normal(f'client-key-data: {base64.b64encode(private_key.encode("utf-8")).decode("utf-8")}')
         elif output_format == ArkDPASSOShortLiveClientCertificateFormat.FILE:
-            if not folder:
+            if not folder_path:
                 raise ArkServiceException(
                     f'Folder parameter is required if format is {ArkDPASSOShortLiveClientCertificateFormat.FILE.value}'
                 )
-            if not os.path.exists(folder):
-                os.makedirs(folder)
-            with open(f'{folder}{os.path.sep}{claims["unique_name"]}client_cert.crt', 'w', encoding='utf-8') as file_handle:
+            if not os.path.exists(folder_path):
+                os.makedirs(folder_path)
+            with open(f'{folder_path}{os.path.sep}{claims["unique_name"]}client_cert.crt', 'w', encoding='utf-8') as file_handle:
                 file_handle.write(client_certificate)
-            with open(f'{folder}{os.path.sep}{claims["unique_name"]}client_key.pem', 'w', encoding='utf-8') as file_handle:
+            with open(f'{folder_path}{os.path.sep}{claims["unique_name"]}client_key.pem', 'w', encoding='utf-8') as file_handle:
                 file_handle.write(private_key)
         elif output_format == ArkDPASSOShortLiveClientCertificateFormat.SINGLE_FILE:
             if not folder:
                 raise ArkServiceException(
                     f'Folder parameter is required if format is {ArkDPASSOShortLiveClientCertificateFormat.FILE.value}'
                 )
-            if not os.path.exists(folder):
-                os.makedirs(folder)
-            with open(f'{folder}{os.path.sep}{claims["unique_name"]}client_cert.pem', 'w', encoding='utf-8') as file_handle:
+            if not os.path.exists(folder_path):
+                os.makedirs(folder_path)
+            with open(f'{folder_path}{os.path.sep}{claims["unique_name"]}client_cert.pem', 'w', encoding='utf-8') as file_handle:
                 file_handle.write(client_certificate)
                 file_handle.write('\n')
                 file_handle.write(private_key)
@@ -107,32 +114,35 @@ class ArkDPASSOService(ArkService):
             raise ArkServiceException(f'Unknown format {output_format}')
 
     def __save_oracle_sso_wallet(self, folder: str, unzip_wallet: bool, result: ArkDPASSOAcquireTokenResponse) -> None:
+        folder_path = self.__expand_folder(folder)
         result.token['wallet'] = base64.b64decode(result.token['wallet'])
-        if not os.path.exists(folder):
-            os.makedirs(folder)
+        if not os.path.exists(folder_path):
+            os.makedirs(folder_path)
         if not unzip_wallet:
-            with open(f'{folder}{os.path.sep}wallet.zip', 'wb') as file_handle:
+            with open(f'{folder_path}{os.path.sep}wallet.zip', 'wb') as file_handle:
                 file_handle.write(result.token['wallet'])
         else:
             wallet_bytes = BytesIO(result.token['wallet'])
             with zipfile.ZipFile(wallet_bytes, 'r') as zipf:
-                zipf.extractall(folder)
+                zipf.extractall(folder_path)
 
     def __save_oracle_pem_wallet(self, folder: str, result: ArkDPASSOAcquireTokenResponse) -> None:
+        folder_path = self.__expand_folder(folder)
         claims = get_unverified_claims(self.__client.session_token)
         pem_wallet = base64.b64decode(result.token['pem_wallet']).decode('utf-8')
-        if not os.path.exists(folder):
-            os.makedirs(folder)
-        with open(f'{folder}{os.path.sep}{claims["unique_name"]}ewallet.pem', 'w', encoding='utf-8') as file_handle:
+        if not os.path.exists(folder_path):
+            os.makedirs(folder_path)
+        with open(f'{folder_path}{os.path.sep}{claims["unique_name"]}ewallet.pem', 'w', encoding='utf-8') as file_handle:
             file_handle.write(pem_wallet)
 
     def __save_rdp_file(self, get_short_lived_rdp_file: ArkDPASSOGetShortLivedRDPFile, result: ArkDPASSOAcquireTokenResponse) -> None:
-        if not os.path.exists(get_short_lived_rdp_file.folder):
-            os.makedirs(get_short_lived_rdp_file.folder)
+        folder_path = self.__expand_folder(get_short_lived_rdp_file.folder)
+        if not os.path.exists(folder_path):
+            os.makedirs(folder_path)
         filename: str = f'dpa _a {get_short_lived_rdp_file.target_address}'
         if get_short_lived_rdp_file.target_domain:
             filename += f' _d {get_short_lived_rdp_file.target_domain}'
-        with open(f'{get_short_lived_rdp_file.folder}{filename}.rdp', 'w', encoding='utf-8') as file_handle:
+        with open(f'{folder_path}{filename}.rdp', 'w', encoding='utf-8') as file_handle:
             file_handle.write(result.token['text'])
 
     def short_lived_password(self, get_short_lived_password: ArkDPASSOGetShortLivedPassword) -> str:

{ark_sdk_python-1.0.4.dist-info → ark_sdk_python-1.0.6.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: ark-sdk-python
-Version: 1.0.4
+Version: 1.0.6
 Summary: Official Ark SDK / CLI for CyberArk Identity Security Platform
 Home-page: https://github.com/cyberark/ark-sdk-python
 License: Apache-2.0