ark-sdk-python 2.0.0__py3-none-any.whl → 2.0.2__py3-none-any.whl

ark_sdk_python/args/ark_pydantic_argparse.py

@@ -514,6 +514,7 @@ class ArkPydanticArgparse:
                     'properties' not in schema['properties'][prop_name]
                     and (
                         'additionalProperties' in schema['properties'][prop_name]
+                        and isinstance(schema['properties'][prop_name]['additionalProperties'], dict)
                         and 'type' in schema['properties'][prop_name]['additionalProperties']
                         and len(schema['properties'][prop_name]['additionalProperties']) == 1
                     )

ark_sdk_python/ark.py

@@ -17,7 +17,7 @@ from ark_sdk_python.actions import ArkAction, ArkCacheAction, ArkConfigureAction
 
 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
-__version__ = '2.0.0'
+__version__ = '2.0.2'
 
 
 def main():

ark_sdk_python/common/ark_jwt_utils.py

@@ -10,3 +10,13 @@ class ArkJWTUtils:
             token,
             options={'verify_signature': False},
         )
+
+    @staticmethod
+    def get_subdomain_from_token(token: str) -> str:
+        claims = ArkJWTUtils.get_unverified_claims(token)
+        return claims.get('subdomain', '')
+
+    @staticmethod
+    def get_platform_domain_from_token(token: str) -> str:
+        claims = ArkJWTUtils.get_unverified_claims(token)
+        return claims.get('platform_domain', '')

ark_sdk_python/common/connections/ssh/__init__.py

@@ -1,3 +1,4 @@
+from ark_sdk_python.common.connections.ssh.ark_pty_ssh_connection import ArkPTYSSHConnection
 from ark_sdk_python.common.connections.ssh.ark_ssh_connection import SSH_PORT, ArkSSHConnection
 
-__all__ = ['ArkSSHConnection', 'SSH_PORT']
+__all__ = ['ArkSSHConnection', 'ArkPTYSSHConnection', 'SSH_PORT']

ark_sdk_python/common/connections/ssh/ark_pty_ssh_connection.py

@@ -0,0 +1,142 @@
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Any, Optional
+
+from overrides import overrides
+from pexpect import pxssh
+
+from ark_sdk_python.common.connections.ark_connection import ArkConnection
+from ark_sdk_python.common.connections.ssh.ark_ssh_connection import SSH_PORT
+from ark_sdk_python.models import ArkException
+from ark_sdk_python.models.common.connections import ArkConnectionCommand, ArkConnectionDetails, ArkConnectionResult
+
+
+class ArkPTYSSHConnection(ArkConnection):
+    __ANSI_STRIPPER: Any = re.compile(r'\x1b[^m]*m|\x1b\[\?2004[hl]')
+
+    def __init__(self):
+        super().__init__()
+        self.__is_connected: bool = False
+        self.__is_suspended: bool = False
+        self.__ssh_client: Optional[pxssh.pxssh] = None
+
+    @overrides
+    def connect(self, connection_details: ArkConnectionDetails) -> None:
+        """
+        Performs SSH connection with given details or keys
+        Saves the ssh session to be used for command executions
+
+        Args:
+            connection_details (ArkConnectionDetails): _description_
+
+        Raises:
+            ArkException: _description_
+        """
+        if self.__is_connected:
+            return
+        try:
+            target_port = SSH_PORT
+            user = None
+            if connection_details.port:
+                target_port = connection_details.port
+            credentials_map = {}
+            if connection_details.credentials:
+                user = connection_details.credentials.user
+                if connection_details.credentials.password:
+                    credentials_map['password'] = connection_details.credentials.password.get_secret_value()
+                elif connection_details.credentials.private_key_filepath:
+                    path = Path(connection_details.credentials.private_key_filepath)
+                    if not path.exists():
+                        raise ArkException(f'Given private key path [{path}] does not exist')
+                    credentials_map['ssh_key'] = connection_details.credentials.private_key_filepath
+            self.__ssh_client = pxssh.pxssh()
+            self.__ssh_client.login(
+                server=connection_details.address,
+                username=user,
+                port=target_port,
+                login_timeout=30,
+                **credentials_map,
+            )
+            self.__is_connected = True
+            self.__is_suspended = False
+        except Exception as ex:
+            raise ArkException(f'Failed to ssh connect [{str(ex)}]') from ex
+
+    @overrides
+    def disconnect(self) -> None:
+        """
+        Disconnects the ssh session
+        """
+        if not self.__is_connected:
+            return
+        self.__ssh_client.logout()
+        self.__ssh_client = None
+        self.__is_connected = False
+        self.__is_suspended = False
+
+    @overrides
+    def suspend_connection(self) -> None:
+        """
+        Suspends execution of ssh commands
+        """
+        self.__is_suspended = True
+
+    @overrides
+    def restore_connection(self) -> None:
+        """
+        Restores execution of ssh commands
+        """
+        self.__is_suspended = False
+
+    @overrides
+    def is_suspended(self) -> bool:
+        """
+        Checks whether ssh commands can be executed or not
+
+        Returns:
+            bool: _description_
+        """
+        return self.__is_suspended
+
+    @overrides
+    def is_connected(self) -> bool:
+        """
+        Checks whether theres a ssh session connected
+
+        Returns:
+            bool: _description_
+        """
+        return self.__is_connected
+
+    @overrides
+    def run_command(self, command: ArkConnectionCommand) -> ArkConnectionResult:
+        """
+        Runs a command over ssh session, returning the result accordingly
+
+        Args:
+            command (ArkConnectionCommand): _description_
+
+        Raises:
+            ArkException: _description_
+
+        Returns:
+            ArkConnectionResult: _description_
+        """
+        if not self.__is_connected or self.__is_suspended:
+            raise ArkException('Cannot run command while not being connected')
+        self._logger.debug(f'Running command [{command.command}]')
+        self.__ssh_client.sendline(command.command)
+        self.__ssh_client.prompt()
+        stdout = self.__ssh_client.before.decode()
+        self.__ssh_client.sendline('echo $?')
+        self.__ssh_client.prompt()
+        exit_code_output = self.__ssh_client.before.decode()
+        exit_code_output = ArkPTYSSHConnection.__ANSI_STRIPPER.sub('', exit_code_output)
+        rc = int(exit_code_output.strip().splitlines()[-1])
+        if rc != command.expected_rc and command.raise_on_error:
+            raise ArkException(f'Failed to execute command [{command.command}] - [{rc}] - [{stdout}]')
+        self._logger.debug(f'Command rc: [{rc}]')
+        self._logger.debug(f'Command stdout: [{stdout}]')
+        return ArkConnectionResult(stdout=stdout, rc=rc)

ark_sdk_python/examples/validate_ssh_connection.py

@@ -0,0 +1,145 @@
+import argparse
+import tempfile
+
+from ark_sdk_python.auth import ArkISPAuth
+from ark_sdk_python.common.ark_jwt_utils import ArkJWTUtils
+from ark_sdk_python.common.connections.ssh.ark_pty_ssh_connection import ArkPTYSSHConnection
+from ark_sdk_python.models.auth import ArkAuthMethod, ArkAuthProfile, ArkSecret
+from ark_sdk_python.models.auth.ark_auth_method import IdentityServiceUserArkAuthMethodSettings
+from ark_sdk_python.models.common.connections.ark_connection_command import ArkConnectionCommand
+from ark_sdk_python.models.common.connections.ark_connection_credentials import ArkConnectionCredentials
+from ark_sdk_python.models.common.connections.ark_connection_details import ArkConnectionDetails
+from ark_sdk_python.models.services.sia.sso.ark_sia_sso_get_ssh_key import ArkSIASSOGetSSHKey
+from ark_sdk_python.services.sia.sso import ArkSIASSOService
+
+
+def login_to_identity_security_platform(service_user: str, service_token: str, application_name: str) -> ArkISPAuth:
+    """
+    This will perform login to the tenant with the given service user credentials
+    Caching the logged in token is disabled and will perform a full login on each call
+    Will return an identity security platform authenticated class
+
+    Args:
+        service_user (str): _description_
+        service_token (str): _description_
+        application_name (str): _description_
+
+    Returns:
+        ArkISPAuth: _description_
+    """
+    print('Logging in to the tenant')
+    isp_auth = ArkISPAuth(cache_authentication=False)
+    isp_auth.authenticate(
+        auth_profile=ArkAuthProfile(
+            username=service_user,
+            auth_method=ArkAuthMethod.IdentityServiceUser,
+            auth_method_settings=IdentityServiceUserArkAuthMethodSettings(identity_authorization_application=application_name),
+        ),
+        secret=ArkSecret(secret=service_token),
+    )
+    print('Logged in successfully')
+    return isp_auth
+
+
+def construct_ssh_proxy_address(isp_auth: ArkISPAuth) -> str:
+    """
+    For a given authentication, construct the SSH proxy address
+    This'll grab from the ID token of the logged in user the name of the tenant (subdomain)
+    And the platform domain (cyberark.cloud)
+    And will concatenante everything to construct the SSH proxy address
+    will return the constructed ssh proxy address
+
+    Args:
+        isp_auth (ArkISPAuth): _description_
+
+    Returns:
+        str: _description_
+    """
+    token = isp_auth.token.token.get_secret_value()
+    return f'{ArkJWTUtils.get_subdomain_from_token(token)}.ssh.{ArkJWTUtils.get_platform_domain_from_token(token)}'
+
+
+def generate_mfa_caching_ssh_key(isp_auth: ArkISPAuth, folder: str) -> str:
+    """
+    This function will use the logged in user
+    And generate an SSH key into a given folder
+    Will return the path to the SSH key
+
+    Args:
+        isp_auth (ArkISPAuth): _description_
+        temp_folder (str): _description_
+
+    Returns:
+        str: _description_
+    """
+    print('Generating SSH MFA Caching Key')
+    sso_service = ArkSIASSOService(isp_auth=isp_auth)
+    path = sso_service.short_lived_ssh_key(get_ssh_key=ArkSIASSOGetSSHKey(folder=folder))
+    print(f'MFA Caching SSH Key generated to [{path}]')
+    return path
+
+
+def connect_and_validate_connection(ssh_key_path: str, proxy_address: str, connection_string: str, command: str) -> None:
+    """
+    This function will perform a connection via SSH and via SIA proxy to the target
+    For the given proxy address and connection string, a connection will be made with the ssh key
+    Once connected, the given command will be performed, expecting a return code of 0 as success
+
+    Args:
+        ssh_key_path (str): _description_
+        proxy_address (str): _description_
+        connection_string (str): _description_
+        command (str): _description_
+    """
+    print(f'Connecting to proxy [{proxy_address}] and connection string [{connection_string}]')
+    ssh_connection = ArkPTYSSHConnection()
+    ssh_connection.connect(
+        ArkConnectionDetails(
+            address=proxy_address,
+            credentials=ArkConnectionCredentials(
+                user=connection_string,
+                private_key_filepath=ssh_key_path,
+            ),
+        ),
+    )
+    print(f'Running test command [{command}]')
+    ssh_connection.run_command(
+        ArkConnectionCommand(command=command, expected_rc=0),
+    )
+    print('Finished Successfully!')
+
+
+if __name__ == '__main__':
+    # Construct an argument parser for CLI parameters for the script
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--service-user', required=True, help='Service user to login and perform the operation with')
+    parser.add_argument('--service-token', required=True, help='Service user token to use for logging in and connecting')
+    parser.add_argument(
+        '--service-application',
+        default='__idaptive_cybr_user_oidc',
+        help='Service application to login to, defaults to cyberark ISP application',
+    )
+    parser.add_argument(
+        '--connection-string',
+        required=True,
+        help='SSH connection string to use for the connection, without the proxy address.'
+        'A connection string may look like the following'
+        '<service-user>#<tenant_subdomain>@<target_user>@<target_address>#<optional_network_name>',
+    )
+    parser.add_argument('--test-command', default='ls -l', help='Test command to use once connected to the target, defaults to ls -l')
+
+    # Parse the CLI parameters
+    args = parser.parse_args()
+
+    # Construct a temporary folder to be used for the MFA Caching SSH key generation
+    # At the end of the execution, the temporary folder will be deleted alongside the SSH key
+    with tempfile.TemporaryDirectory() as temp_folder:
+        # Perform the flow:
+        # - Login to the tenant
+        # - Generate an MFA Caching SSH key
+        # - Construct the ssh proxy address
+        # - Connect in SSH to the proxy / target with the MFA Caching SSH Key and perform the command
+        isp_auth = login_to_identity_security_platform(args.service_user, args.service_token, args.service_application)
+        ssh_key_path = generate_mfa_caching_ssh_key(isp_auth, temp_folder)
+        proxy_address = construct_ssh_proxy_address(isp_auth)
+        connect_and_validate_connection(ssh_key_path, proxy_address, args.connection_string, args.test_command)

{ark_sdk_python-2.0.0.dist-info → ark_sdk_python-2.0.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: ark-sdk-python
-Version: 2.0.0
+Version: 2.0.2
 Summary: Official Ark SDK / CLI for CyberArk Identity Security Platform
 License: Apache-2.0
 Author: CyberArk
@@ -29,6 +29,7 @@ Requires-Dist: keyrings.cryptfile
 Requires-Dist: overrides
 Requires-Dist: packaging
 Requires-Dist: paramiko
+Requires-Dist: pexpect
 Requires-Dist: progress
 Requires-Dist: pycryptodome
 Requires-Dist: pydantic (==2.*)

{ark_sdk_python-2.0.0.dist-info → ark_sdk_python-2.0.2.dist-info}/RECORD

@@ -9,8 +9,8 @@ ark_sdk_python/actions/ark_profiles_action.py,sha256=luUe-8pmDuzGyBqFcxXZZcLFUrZ
 ark_sdk_python/actions/ark_service_exec_action.py,sha256=IHIm9oISRThOD8WNJe4oJX-9CTpH8WUuGlXxlcLvNxI,5127
 ark_sdk_python/args/__init__.py,sha256=mCb4UrIRL4u58QyUbqqH2xAU0VN91pxjK5sa_UwCM_k,279
 ark_sdk_python/args/ark_args_formatter.py,sha256=-Rs_rGMIr1bprD1SfYlMsLoSOFgr_RFrRdREvbmPU6k,9204
-ark_sdk_python/args/ark_pydantic_argparse.py,sha256=zqaYfrPrgRe6b0a7iO4Tuu8O6nJvRPe3-uZuQDihmIk,39981
-ark_sdk_python/ark.py,sha256=KQEEb0ZL7cgalWYfKktaEheENhylSugig4BHVX8TDmw,1280
+ark_sdk_python/args/ark_pydantic_argparse.py,sha256=uupNLnUmO5LrTrRZsBv7qRKgDsx4GaJMwOUh1TCc1-w,40083
+ark_sdk_python/ark.py,sha256=eI5sMAgh2sbPrOyb1aqvj3R0GmTdiKD3PQvSokyNVVI,1280
 ark_sdk_python/ark_api.py,sha256=qEB2j-xf8kiSdAvTXrvEdqGDQ-l1aoEvktxnq7BYNRI,12486
 ark_sdk_python/auth/__init__.py,sha256=1l29Rf3VhwmV8z3YROiQVcgrZYSeeCqVN4zna77tnlk,620
 ark_sdk_python/auth/ark_auth.py,sha256=2fPlABM3AwWmb1h0lQPQAz93u1ZluYKv7axlfg4lq5Q,12988
@@ -32,7 +32,7 @@ ark_sdk_python/common/__init__.py,sha256=QpzMfvy7yl_kw5B5uYuQkVhIw_p1QH5Vvm4lHpK
 ark_sdk_python/common/ark_async_client.py,sha256=GxFxn8hJbVisCyHmTUiVxhEIOCj9j-_ijAZsoSxnvbs,2518
 ark_sdk_python/common/ark_async_request.py,sha256=03q-U4K6oHJ18UNjQcJWT01plfZDNe74RI7iQqJmQmY,1885
 ark_sdk_python/common/ark_client.py,sha256=iUoAS8ws-CxDlO1jN0hccuEI0NArMHYGacC0rAlCiho,7802
-ark_sdk_python/common/ark_jwt_utils.py,sha256=wueVpV-0q6M9Uo0GNbGKj8AdZ1edKvP2GXUEHUK6FM0,280
+ark_sdk_python/common/ark_jwt_utils.py,sha256=0Qh0HnU3f9t1X2L3juZHrOBWKrmBXAbV7zdsyeoYYvs,638
 ark_sdk_python/common/ark_keyring.py,sha256=xPmR7zt0sMZF6qWpeG-8irgOQXAX6au-ykIzKv0dSKo,11271
 ark_sdk_python/common/ark_logger.py,sha256=l06FH2dg6AkpR8M6zVoZVgaiyOZ2G9ANxHNahPDHVEE,2445
 ark_sdk_python/common/ark_page.py,sha256=4_kycDX8vLloyZOlbM8N9XYXiF2cb5O-l4FbZ5hA7CY,358
@@ -42,7 +42,8 @@ ark_sdk_python/common/ark_retry.py,sha256=fWkKYLIK2z5U14NFzhqUP_o0VkSG9F9EiZIhdf
 ark_sdk_python/common/ark_system_config.py,sha256=cl44cYSgXZEnoRYu048aBeJwWRPdCT_flC3hTWyytX4,2436
 ark_sdk_python/common/connections/__init__.py,sha256=RyARha6jTeaUw1cIGBSR7nOYxCV3fC24juKb-17yXLw,104
 ark_sdk_python/common/connections/ark_connection.py,sha256=wjYpn_9EJ-B679006VqQREFeTOhINmw-heiRqlpuCnY,1613
-ark_sdk_python/common/connections/ssh/__init__.py,sha256=kS5Y1oIt4ncax68et2ykPwGA07taVUUpW-saCDiLwBk,140
+ark_sdk_python/common/connections/ssh/__init__.py,sha256=Ycv3BDI2iw-N7BdRkpAv2Qi90O4bp8sPyNsJnuQLfWo,256
+ark_sdk_python/common/connections/ssh/ark_pty_ssh_connection.py,sha256=PRrS3pcVdW6Ike6AWnh5JuOLhcYJC7nJHQOf6VZa_kI,4973
 ark_sdk_python/common/connections/ssh/ark_ssh_connection.py,sha256=yVtrM_clLScg1uNY-Fextiup59h2AIbKxQQadLfiqpw,5195
 ark_sdk_python/common/connections/winrm/__init__.py,sha256=TX8jEK5BPwvlzgo8lH4sGDcY9oL593rdEutQL4MMra4,164
 ark_sdk_python/common/connections/winrm/ark_winrm_connection.py,sha256=O8ifpvmuzFpvqvjb3wFmg576v5jFZwFHi20wlV2UtwE,6854
@@ -56,6 +57,7 @@ ark_sdk_python/examples/create_sia_vm_environment.py,sha256=omk2mb1yrAU8w3mNSqjH
 ark_sdk_python/examples/default_suffix.py,sha256=GEAnsrVhNdsIZ2YRJd4Xs4HYv86UdmXwPwOs7ajcQIQ,662
 ark_sdk_python/examples/list_pcloud_accounts.py,sha256=Xzq_LIp_woRgCt73w1AMlXbB6P8yNRHr1VGIBCyQswk,810
 ark_sdk_python/examples/session_monitoring_activites.py,sha256=WSGISA4Qye8q22WpiHq0HKYTfbwLK7038mRHp2Kr9IQ,1632
+ark_sdk_python/examples/validate_ssh_connection.py,sha256=hSUtmADqupxEkbKRTvC0MKmJBHfe-PYltVP0u8sHuhQ,6357
 ark_sdk_python/models/__init__.py,sha256=2EKDAGANDadQfJrnTjm2Jc7JnINcZOwCRXWHEXmIH6o,1082
 ark_sdk_python/models/actions/__init__.py,sha256=2xPZhoHco50bmPX7rm6uPOAcYURoTP9J5KF4E3XNaFA,743
 ark_sdk_python/models/actions/ark_configure_action_consts.py,sha256=-YNgiGv1GsQx-JvO0eXXrrOlDcH6sRDLdO7kvTHto-M,1143
@@ -477,9 +479,9 @@ ark_sdk_python/services/sia/workspaces/targetsets/__init__.py,sha256=UjHr81LMcMl
 ark_sdk_python/services/sia/workspaces/targetsets/ark_sia_target_sets_workspace_service.py,sha256=o9_DzskTV94kkfc4m0Qk8lj5FV8rexRa5RzRwfe9Tbo,11254
 ark_sdk_python/services/sm/__init__.py,sha256=jzKxEkZYOCW9y_byLfd_odae9m2sh1UfjaaKBVySWY0,95
 ark_sdk_python/services/sm/ark_sm_service.py,sha256=Rh2dFjNz7VMJUnl43hxL07HEZ8_33KrU_lqfUrqUDn4,11517
-ark_sdk_python-2.0.0.dist-info/LICENSE.txt,sha256=d4EzYx2apA3-GqrFY23wLtc6UmQNXG05gyLfZ3oWVRs,11358
-ark_sdk_python-2.0.0.dist-info/METADATA,sha256=8no-3v6kS7TkN1nbd9utxx7Bk8VTIJLemREC1tcA278,20079
-ark_sdk_python-2.0.0.dist-info/NOTICES.md,sha256=cuG6J8u9QVu5ZjYki-McJmoEmi39foN30IxA_2fNnKY,125667
-ark_sdk_python-2.0.0.dist-info/WHEEL,sha256=CIaYlaP0GnhA0Mv3ERDC3CMg_oGwHXYV1sPT7AFbDI4,110
-ark_sdk_python-2.0.0.dist-info/entry_points.txt,sha256=v5bcuRn8w42ZKQspfvX3AliKmLVO6f7Zb_bma77p3vQ,47
-ark_sdk_python-2.0.0.dist-info/RECORD,,
+ark_sdk_python-2.0.2.dist-info/LICENSE.txt,sha256=d4EzYx2apA3-GqrFY23wLtc6UmQNXG05gyLfZ3oWVRs,11358
+ark_sdk_python-2.0.2.dist-info/METADATA,sha256=N2GVS4nUgCu0WWdDFBihVWTYqqBz8ocGXhB0OM8vsLU,20102
+ark_sdk_python-2.0.2.dist-info/NOTICES.md,sha256=cuG6J8u9QVu5ZjYki-McJmoEmi39foN30IxA_2fNnKY,125667
+ark_sdk_python-2.0.2.dist-info/WHEEL,sha256=QymApwX2NnTrOAORdnrvo1YegSC1EN2pJY0mOd9rfdE,110
+ark_sdk_python-2.0.2.dist-info/entry_points.txt,sha256=v5bcuRn8w42ZKQspfvX3AliKmLVO6f7Zb_bma77p3vQ,47
+ark_sdk_python-2.0.2.dist-info/RECORD,,

{ark_sdk_python-2.0.0.dist-info → ark_sdk_python-2.0.2.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: poetry-core 2.1.1
+Generator: poetry-core 2.1.2
 Root-Is-Purelib: true
 Tag: py3-none-any