ark-sdk-python 2.1.2__py3-none-any.whl → 2.1.4__py3-none-any.whl

ark_sdk_python/auth/identity/ark_identity.py

@@ -92,11 +92,11 @@ class ArkIdentity:
     ) -> None:
         self.__username = username
         self.__password = password
+        self.__logger = logger or get_logger(app=self.__class__.__name__)
         self.__identity_url = self.__resolve_fqdn_from_username_or_subdomain(identity_url, identity_tenant_subdomain)
         if not self.__identity_url.startswith('https://'):
             self.__identity_url = f'https://{self.__identity_url}'
         self.__mfa_type = mfa_type or 'email'
-        self.__logger = logger or get_logger(app=self.__class__.__name__)
         self.__interaction_process: Optional[Process] = None
         self.__is_polling: bool = False
         self.__keyring = ArkKeyring(self.__class__.__name__.lower()) if cache_authentication else None
@@ -204,17 +204,20 @@ class ArkIdentity:
         return parsed_res
 
     def __advance_authentication(
-        self, mechanism_id: str, session_id: str, answer: str, action: str
-    ) -> Union[AdvanceAuthMidResponse, AdvanceAuthResponse]:
+        self, mechanism_id: str, session_id: str, answer: str, action: str, is_idp_auth: bool = False
+    ) -> Union[AdvanceAuthMidResponse, AdvanceAuthResponse, IdpAuthStatusResponse]:
         self.__logger.info(f'Advancing authentication with user {self.__username} and fqdn {self.__identity_url} and action {action}')
         response = self.__session.post(
             url=f'{self.__identity_url}/Security/AdvanceAuthentication',
             json={'SessionId': session_id, 'MechanismId': mechanism_id, 'Action': action, 'Answer': answer},
         )
         try:
-            parsed_res: AdvanceAuthMidResponse = AdvanceAuthMidResponse.model_validate_json(response.text)
-            if parsed_res.result.summary == 'LoginSuccess':
-                parsed_res: AdvanceAuthResponse = AdvanceAuthResponse.model_validate_json(response.text)
+            if is_idp_auth:
+                parsed_res: IdpAuthStatusResponse = IdpAuthStatusResponse.model_validate_json(response.text)
+            else:
+                parsed_res: AdvanceAuthMidResponse = AdvanceAuthMidResponse.model_validate_json(response.text)
+                if parsed_res.result.summary == 'LoginSuccess':
+                    parsed_res: AdvanceAuthResponse = AdvanceAuthResponse.model_validate_json(response.text)
         except (ValidationError, TypeError) as ex:
             raise ArkException(f'Identity advance authentication failed to be parsed / validated [{response.text}]') from ex
         return parsed_res
@@ -281,14 +284,16 @@ class ArkIdentity:
                 if output_conn.poll():
                     mfa_code = output_conn.recv()
                     advance_resp = self.__advance_authentication(
-                        mechanism.mechanism_id, start_auth_response.result.session_id, mfa_code, 'Answer'
+                        mechanism.mechanism_id, start_auth_response.result.session_id, mfa_code, 'Answer', False
                     )
                     if isinstance(advance_resp, AdvanceAuthResponse):
                         input_conn.send('DONE')
                     else:
                         input_conn.send('CONTINUE')
                 else:
-                    advance_resp = self.__advance_authentication(mechanism.mechanism_id, start_auth_response.result.session_id, '', 'Poll')
+                    advance_resp = self.__advance_authentication(
+                        mechanism.mechanism_id, start_auth_response.result.session_id, '', 'Poll', False
+                    )
                 if isinstance(advance_resp, AdvanceAuthResponse):
                     # Done here, save the token
                     self.__is_polling = False
@@ -340,6 +345,37 @@ class ArkIdentity:
         self.__mfa_type = next(filter(lambda f: factors[f] == answers['mfa'], factors.keys()))
         return next(filter(lambda m: factors[m.name.lower()] == answers['mfa'], supported_mechanisms))
 
+    def __perform_pin_code_idp_authentication(
+        self, start_auth_response: StartAuthResponse, profile: Optional[ArkProfile] = None, interactive: bool = False
+    ) -> None:
+        if not interactive:
+            raise ArkException('Non-interactive mode is not supported for OOB PIN code authentication')
+        answers = inquirer.prompt(
+            [inquirer.Password('answer', message='Please enter the PIN code displayed after you logged in to your identity provider')],
+            render=ArkInquirerRender(),
+        )
+        if not answers:
+            raise ArkAuthException('Canceled by user')
+        pin_code = answers['answer']
+        result = self.__advance_authentication('OOBAUTHPIN', start_auth_response.result.idp_login_session_id, pin_code, 'Answer', True)
+        if (
+            not result
+            or not result.success
+            or not isinstance(result, IdpAuthStatusResponse)
+            or not result.result.summary
+            or result.result.summary != 'LoginSuccess'
+            or not result.result.token
+        ):
+            raise ArkAuthException('Failed to perform idp authentication with OOB PIN')
+        # We managed to successfully authenticate
+        # Done here, save the token
+        self.__session_details = result.result
+        self.__session.headers.update({'Authorization': f'Bearer {result.result.token}', **ArkIdentityFQDNResolver.default_headers()})
+        delta = self.__session_details.token_lifetime or DEFAULT_TOKEN_LIFETIME_SECONDS
+        self.__session_exp = datetime.now() + timedelta(seconds=delta)
+        if self.__cache_authentication:
+            self.__save_cache(profile)
+
     def __perform_idp_authentication(
         self, start_auth_response: StartAuthResponse, profile: Optional[ArkProfile] = None, interactive: bool = False
     ) -> None:
@@ -356,6 +392,11 @@ class ArkIdentity:
         # Error can be ignored
         webbrowser.open(start_auth_response.result.idp_redirect_short_url, new=0, autoraise=True)
 
+        # Pin code flow
+        if start_auth_response.result.idp_oob_auth_pin_required:
+            self.__perform_pin_code_idp_authentication(start_auth_response, profile, interactive)
+            return
+
         # Start polling for idp auth
         self.__is_polling = True
         start_time = datetime.now()
@@ -400,7 +441,7 @@ class ArkIdentity:
                 raise ArkAuthException('Canceled by user')
             self.__password = answers['answer']
         advance_resp = self.__advance_authentication(
-            mechanism.mechanism_id, start_auth_response.result.session_id, self.__password, 'Answer'
+            mechanism.mechanism_id, start_auth_response.result.session_id, self.__password, 'Answer', False
         )
         if isinstance(advance_resp, AdvanceAuthResponse) and len(start_auth_response.result.challenges) == 1:
             # Done here, save the token
@@ -568,7 +609,7 @@ class ArkIdentity:
                     return
             else:
                 oob_advance_resp = self.__advance_authentication(
-                    mechanism.mechanism_id, start_auth_response.result.session_id, '', 'StartOOB'
+                    mechanism.mechanism_id, start_auth_response.result.session_id, '', 'StartOOB', False
                 )
                 self.__poll_authentication(profile, mechanism, start_auth_response, oob_advance_resp, interactive)
                 if self.__session_details:
@@ -591,7 +632,7 @@ class ArkIdentity:
             for mechanism in start_auth_response.result.challenges[current_challenge_idx].mechanisms:
                 if mechanism.name.lower() == self.__mfa_type.lower():
                     oob_advance_resp = self.__advance_authentication(
-                        mechanism.mechanism_id, start_auth_response.result.session_id, '', 'StartOOB'
+                        mechanism.mechanism_id, start_auth_response.result.session_id, '', 'StartOOB', False
                     )
                     self.__poll_authentication(profile, mechanism, start_auth_response, oob_advance_resp, interactive)
                     return
@@ -602,7 +643,9 @@ class ArkIdentity:
         # Handle the rest of the challenges, might also handle the first challenge if no password is in the mechanisms
         for challenge in start_auth_response.result.challenges[current_challenge_idx:]:
             mechanism = self.__pick_mechanism(challenge)
-            oob_advance_resp = self.__advance_authentication(mechanism.mechanism_id, start_auth_response.result.session_id, '', 'StartOOB')
+            oob_advance_resp = self.__advance_authentication(
+                mechanism.mechanism_id, start_auth_response.result.session_id, '', 'StartOOB', False
+            )
             self.__poll_authentication(profile, mechanism, start_auth_response, oob_advance_resp, interactive)
 
     # pylint: disable=unused-argument

ark_sdk_python/common/ark_version.py

@@ -1 +1 @@
-__version__ = '2.1.2'
+__version__ = '2.1.4'

ark_sdk_python/common/connections/winrm/ark_winrm_connection.py

@@ -1,4 +1,5 @@
 import base64
+import os
 import uuid
 from typing import Any, Final, Optional
 
@@ -9,6 +10,7 @@ from ark_sdk_python.models import ArkException
 from ark_sdk_python.models.common.connections import ArkConnectionCommand, ArkConnectionDetails, ArkConnectionResult
 
 WINRM_HTTPS_PORT: Final[int] = 5986
+IGNORE_CERT_VALIDATION_ENV_VAR: Final[str] = 'ARK_WINRM_NO_SSL_CERT_VALIDATION'
 
 
 class ArkWinRMConnection(ArkConnection):
@@ -48,13 +50,18 @@ class ArkWinRMConnection(ArkConnection):
                     password = connection_details.credentials.password.get_secret_value()
             if connection_details.connection_data and connection_details.connection_data.certificate:
                 cert = connection_details.connection_data.certificate
+            server_cert_validation = 'validate'
+            if len(os.getenv(IGNORE_CERT_VALIDATION_ENV_VAR, '')) > 0 or (
+                connection_details.connection_data and not connection_details.connection_data.validate_certificate
+            ):
+                server_cert_validation = 'ignore'
             self.__winrm_protocol = winrm.Protocol(
                 endpoint=f'https://{connection_details.address}:' f'{target_port}/wsman',
                 transport='ntlm',
                 username=user,
                 password=password,
                 ca_trust_path=cert,
-                server_cert_validation='ignore',
+                server_cert_validation=server_cert_validation,
                 read_timeout_sec=10,
                 operation_timeout_sec=5,
             )

ark_sdk_python/models/common/connections/connection_data/ark_winrm_connection_data.py

@@ -7,3 +7,4 @@ from ark_sdk_python.models import ArkModel
 
 class ArkWinRMConnectionData(ArkModel):
     certificate: Optional[str] = Field(description="Certificate to use for connection transport", default=None)
+    validate_certificate: bool = Field(description="Whether to validate the SSL certificate", default=True)

ark_sdk_python/models/common/identity/ark_identity_auth_schemas.py

@@ -49,14 +49,28 @@ class StartAuthResult(ArkModel):
     idp_login_session_id: Optional[str] = Field(default=None, alias='IdpLoginSessionId')
     idp_redirect_short_url: Optional[str] = Field(default=None, alias='IdpRedirectShortUrl')
     idp_short_url_id: Optional[str] = Field(default=None, alias='IdpShortUrlId')
+    idp_oob_auth_pin_required: Optional[bool] = Field(default=None, alias='IdpOobAuthPinRequired')
     tenant_id: Optional[str] = Field(default=None, alias='TenantId')
 
 
 class IdpAuthStatusResult(ArkModel):
-    state: str = Field(alias='State')
+    auth_level: Optional[str] = Field(default=None, alias='AuthLevel')
+    display_name: Optional[str] = Field(default=None, alias='DisplayName')
+    auth: Optional[str] = Field(default=None, alias='Auth')
+    user_id: Optional[str] = Field(default=None, alias='UserId')
+    state: Optional[str] = Field(default=None, alias='State')
     token_lifetime: Optional[int] = Field(default=None, alias='TokenLifetime')
     token: Optional[str] = Field(default=None, alias='Token')
     refresh_token: Optional[str] = Field(default=None, alias='RefreshToken')
+    email_address: Optional[str] = Field(default=None, alias='EmailAddress')
+    user_directory: Optional[str] = Field(default=None, alias='UserDirectory')
+    pod_fqdn: Optional[str] = Field(default=None, alias='PodFqdn')
+    user: Optional[str] = Field(default=None, alias='User')
+    customer_id: Optional[str] = Field(default=None, alias='CustomerID')
+    forest: Optional[str] = Field(default=None, alias='Forest')
+    system_id: Optional[str] = Field(default=None, alias='SystemID')
+    source_ds_type: Optional[str] = Field(default=None, alias='SourceDsType')
+    summary: Optional[str] = Field(default=None, alias='Summary')
 
 
 class TenantFqdnResponse(IdentityApiResponse):

{ark_sdk_python-2.1.2.dist-info → ark_sdk_python-2.1.4.dist-info}/METADATA

@@ -1,8 +1,10 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: ark-sdk-python
-Version: 2.1.2
+Version: 2.1.4
 Summary: Official Ark SDK / CLI for CyberArk Identity Security Platform
 License: Apache-2.0
+License-File: LICENSE.txt
+License-File: NOTICES.md
 Author: CyberArk
 Author-email: cyberark@cyberark.com
 Requires-Python: >=3.11,<4.0
@@ -14,11 +16,12 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Requires-Dist: aenum
 Requires-Dist: argcomplete
 Requires-Dist: cachetools
 Requires-Dist: colorama
-Requires-Dist: deepdiff (==7.*)
+Requires-Dist: deepdiff (==8.*)
 Requires-Dist: dill
 Requires-Dist: fake-useragent (==1.5.1)
 Requires-Dist: inquirer

{ark_sdk_python-2.1.2.dist-info → ark_sdk_python-2.1.4.dist-info}/RECORD

@@ -16,7 +16,7 @@ ark_sdk_python/auth/__init__.py,sha256=1l29Rf3VhwmV8z3YROiQVcgrZYSeeCqVN4zna77tn
 ark_sdk_python/auth/ark_auth.py,sha256=2fPlABM3AwWmb1h0lQPQAz93u1ZluYKv7axlfg4lq5Q,12988
 ark_sdk_python/auth/ark_isp_auth.py,sha256=i8GIA5ldsT7loJSG898-XQQyg84M-1CJ0aUZa1zcLSc,9689
 ark_sdk_python/auth/identity/__init__.py,sha256=2Yyc_Rrx-D4PsSdg-ESl5pFFTpqu6LUPSc4ZW59oOP8,328
-ark_sdk_python/auth/identity/ark_identity.py,sha256=1S0_-cpIgkHlXoUMxy4eov7m4jPZ2f_5pw3l9aa5-W8,32283
+ark_sdk_python/auth/identity/ark_identity.py,sha256=Shf4VL7ZVpwstrEaIqbN716PEMw6kKEagqa6GSi-bAc,34482
 ark_sdk_python/auth/identity/ark_identity_fqdn_resolver.py,sha256=a2FA8CA4DkVHsiOw_NwTZ-TmE3s19l-kPUoO57nowYc,4715
 ark_sdk_python/auth/identity/ark_identity_service_user.py,sha256=pspgsG3dg5PE0XueVParz3CshTdtQJFLdsoMzrx2wfA,7901
 ark_sdk_python/cli_services/__init__.py,sha256=e9vdwqNiYqhZmK05Wgpz-Hf9SycK_3X-RS3CK9n2lIs,87
@@ -42,7 +42,7 @@ ark_sdk_python/common/ark_random_utils.py,sha256=dmPsvF9lTg90SdrYENmVD6giQdZlb5y
 ark_sdk_python/common/ark_retry.py,sha256=fWkKYLIK2z5U14NFzhqUP_o0VkSG9F9EiZIhdfa_EYY,1815
 ark_sdk_python/common/ark_system_config.py,sha256=cl44cYSgXZEnoRYu048aBeJwWRPdCT_flC3hTWyytX4,2436
 ark_sdk_python/common/ark_user_agent.py,sha256=76v92ulwh_AlfBN1cz5BYkYUzPDfEsQchRXKBG4BTrw,213
-ark_sdk_python/common/ark_version.py,sha256=m5qImnzcnIhayvILFVqEnXPYsN-vE0vxokygykKhRfw,22
+ark_sdk_python/common/ark_version.py,sha256=UMw41rTsoohZA4SAbzzfJDJmGceIhOcOqrNBdGUMy8g,22
 ark_sdk_python/common/connections/__init__.py,sha256=RyARha6jTeaUw1cIGBSR7nOYxCV3fC24juKb-17yXLw,104
 ark_sdk_python/common/connections/ark_connection.py,sha256=wjYpn_9EJ-B679006VqQREFeTOhINmw-heiRqlpuCnY,1613
 ark_sdk_python/common/connections/ssh/__init__.py,sha256=Ycv3BDI2iw-N7BdRkpAv2Qi90O4bp8sPyNsJnuQLfWo,256
@@ -50,7 +50,7 @@ ark_sdk_python/common/connections/ssh/ark_pty_ssh_connection.py,sha256=mhrVYV9vx
 ark_sdk_python/common/connections/ssh/ark_pty_ssh_win_connection.py,sha256=vAAvJ7AMML66B4GVjsSeqzPlJVrrNK2M34TqeVDYg2k,8557
 ark_sdk_python/common/connections/ssh/ark_ssh_connection.py,sha256=yVtrM_clLScg1uNY-Fextiup59h2AIbKxQQadLfiqpw,5195
 ark_sdk_python/common/connections/winrm/__init__.py,sha256=TX8jEK5BPwvlzgo8lH4sGDcY9oL593rdEutQL4MMra4,164
-ark_sdk_python/common/connections/winrm/ark_winrm_connection.py,sha256=O8ifpvmuzFpvqvjb3wFmg576v5jFZwFHi20wlV2UtwE,6854
+ark_sdk_python/common/connections/winrm/ark_winrm_connection.py,sha256=_S3mzSqyvuu7MCEDRDxJHweZ26sSpiesvquHhs_N-n4,7261
 ark_sdk_python/common/env/__init__.py,sha256=bClLAUl9fS1QT_AYQ5vpKBplZ_Pjr8b3XwjKh6klbFE,621
 ark_sdk_python/common/env/ark_env_mapping.py,sha256=D_WKns4yyEtCFtC9OCMLFD-K8gGjhxLwcCej9YJyHZU,1369
 ark_sdk_python/common/isp/__init__.py,sha256=363fvrATSpmR4hCxhh_lmYA6_qcVWCmHTTINrn8-Z8Y,116
@@ -130,9 +130,9 @@ ark_sdk_python/models/common/connections/ark_connection_details.py,sha256=e9bYhS
 ark_sdk_python/models/common/connections/ark_connection_result.py,sha256=ArK18GAd-qEVqW4p0wDcVWi6ZKoK9kKtmvciYxKkEIY,386
 ark_sdk_python/models/common/connections/connection_data/__init__.py,sha256=_zeyIs83DkR1CRGRDUE_3P43siCobRY8OiwL1r0zPzM,294
 ark_sdk_python/models/common/connections/connection_data/ark_ssh_connection_data.py,sha256=41yOuJhRrpJf2T8xg6yuhOwo1eZ1WqNi3Aex1dgE5J8,92
-ark_sdk_python/models/common/connections/connection_data/ark_winrm_connection_data.py,sha256=gH2mEk0NSHsPwpt7NgNIxQQODQq5DSZ_kgW9WrEOS4U,254
+ark_sdk_python/models/common/connections/connection_data/ark_winrm_connection_data.py,sha256=31yp2NPVcpFsMR6ganL7-FZA1ZKTJtv57usUl-_Npp4,362
 ark_sdk_python/models/common/identity/__init__.py,sha256=E-WPD6ZxroVZ4HOrQJdjWrrJYZ-XGBOsjO525DEniHA,1945
-ark_sdk_python/models/common/identity/ark_identity_auth_schemas.py,sha256=DmzMLFH1nat99Xzy-ilTQ_-e88W1S7R0JLgH6Juzdns,3893
+ark_sdk_python/models/common/identity/ark_identity_auth_schemas.py,sha256=zv890mNMURdN7FuIHMJARpt_gTu7sCYxBsypoC03Pn4,4920
 ark_sdk_python/models/common/identity/ark_identity_common_schemas.py,sha256=nhlP-Wa08u_NKRiYdrl4E4fQpIECj6BocXdNfQlgmW8,498
 ark_sdk_python/models/common/identity/ark_identity_directory_schemas.py,sha256=DYM0TigGIqt_ZSyhA-ikN1uDQLkn1WZwZO2Bi6XnUJY,5137
 ark_sdk_python/models/common/isp/__init__.py,sha256=QSvRKyNiBSpzZggBk4p3TzH5YcGF-M5uu08hK2msPBk,141
@@ -577,9 +577,9 @@ ark_sdk_python/services/uap/sia/db/__init__.py,sha256=wnRWgugupaIX-47EkyIplpr17w
 ark_sdk_python/services/uap/sia/db/ark_uap_sia_db_service.py,sha256=cgRFTtwaPssNiF_PmGx3nD1ywSsuxE5kJs5K5xKh3Z4,4017
 ark_sdk_python/services/uap/sia/vm/__init__.py,sha256=-vorR4le7AbvkMIUAdaEDQ774mlFT_Ye_FWqPlwX-C0,123
 ark_sdk_python/services/uap/sia/vm/ark_uap_sia_vm_service.py,sha256=sF0B-fo-LXUlHXMfZbggmdUH5gkjeGAPau8MZ_bBfkU,4015
-ark_sdk_python-2.1.2.dist-info/LICENSE.txt,sha256=d4EzYx2apA3-GqrFY23wLtc6UmQNXG05gyLfZ3oWVRs,11358
-ark_sdk_python-2.1.2.dist-info/METADATA,sha256=GWhT4adDy5_2Ax_9uI5gYebv4Vx0naG46fOgw4lMjNU,22039
-ark_sdk_python-2.1.2.dist-info/NOTICES.md,sha256=vRzFZEsfBw5q3H1_cgZV50AVhNTqF8Smz9fSvn49Y1E,125803
-ark_sdk_python-2.1.2.dist-info/WHEEL,sha256=0IJoS5KyK2sZuSvGyrwXyRwSVwTkTkpEcRzz5xcYUMQ,110
-ark_sdk_python-2.1.2.dist-info/entry_points.txt,sha256=v5bcuRn8w42ZKQspfvX3AliKmLVO6f7Zb_bma77p3vQ,47
-ark_sdk_python-2.1.2.dist-info/RECORD,,
+ark_sdk_python-2.1.4.dist-info/METADATA,sha256=iP95BVbYGRUGpy070fGWLzp7HyLkl3yTFXyyajPzXkU,22141
+ark_sdk_python-2.1.4.dist-info/WHEEL,sha256=fUMeA25No3A80e22zQf2kmVT884hbN_r4CKzknyKkuU,110
+ark_sdk_python-2.1.4.dist-info/entry_points.txt,sha256=v5bcuRn8w42ZKQspfvX3AliKmLVO6f7Zb_bma77p3vQ,47
+ark_sdk_python-2.1.4.dist-info/licenses/LICENSE.txt,sha256=d4EzYx2apA3-GqrFY23wLtc6UmQNXG05gyLfZ3oWVRs,11358
+ark_sdk_python-2.1.4.dist-info/licenses/NOTICES.md,sha256=vRzFZEsfBw5q3H1_cgZV50AVhNTqF8Smz9fSvn49Y1E,125803
+ark_sdk_python-2.1.4.dist-info/RECORD,,

{ark_sdk_python-2.1.2.dist-info → ark_sdk_python-2.1.4.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: poetry-core 2.1.3
+Generator: poetry-core 2.2.1
 Root-Is-Purelib: true
 Tag: py3-none-any