privacyIDEA 3.12__py3-none-any.whl

privacyidea/__init__.py

@@ -0,0 +1,34 @@
+__doc__ = """
+These are the base functions of privacyIDEA app.
+
+app.py
+======
+
+contains the constructor of the app. Call
+
+   create_app(config_name, config_file)
+
+to create a new app instance.
+
+config.py
+=========
+contains configuration objects for development, testing and production.
+These configuration probably will not be enough for you, this is why you will
+need to add configuration in a config file. You pass the config file to the
+create_app() call.
+
+models.py
+=========
+contains the database models of privacyidea.
+
+
+Directory structure
+===================
+The directory /lib/ contains all library functions. These functions are
+independent on any request objects and flask components.
+
+The /api/ directory contains the flasked based REST API of privacyidea.
+
+The /static/ and /webui/ directories contain all components that are needed
+for the WebUI which is implemented as a single page application using angularJS.
+"""

privacyidea/api/__init__.py

@@ -0,0 +1,30 @@
+"""
+This is the REST API for privacyidea. It lets you create the system
+configuration, which is denoted in the system endpoints.
+
+Special system configuration is the configuration of
+
+ * the resolvers
+ * the realms
+ * the defaultrealm
+ * the policies.
+
+Resolvers are dynamic links to existing user sources. You can find users in
+LDAP directories, SQL databases, flat files or SCIM services.
+A resolver translates a loginname to a user object in the user source and
+back again. It is also responsible for fetching all additional needed
+information from the user source.
+
+Realms are collections of resolvers that can be managed by administrators and
+where policies can be applied.
+
+Defaultrealm is a special endpoint to define the default realm. The default
+realm is used if no user realm is specified. If a user from realm1 tries to
+authenticate or is addressed, the notation user@realm1 is used.
+If the @realm1 is omitted, the user is searched in the default realm.
+
+Policies are rules how privacyidea behaves and which user and administrator
+is allowed to do what.
+
+"""
+

privacyidea/api/application.py

@@ -0,0 +1,93 @@
+# http://www.privacyidea.org
+# (c) Cornelius Kölbel, privacyidea.org
+#
+# 2015-02-26 Cornelius Kölbel, <cornelius@privacyidea.org>
+#            Initial writeup
+#
+# This code is free software; you can redistribute it and/or
+# modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
+# License as published by the Free Software Foundation; either
+# version 3 of the License, or any later version.
+#
+# This code is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU AFFERO GENERAL PUBLIC LICENSE for more details.
+#
+# You should have received a copy of the GNU Affero General Public
+# License along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+"""
+This endpoint is used to get the information from the server,
+which application types are known and which options these applications provide.
+
+Applications are used to attach tokens to machines.
+
+The code of this module is tested in tests/test_api_applications.py
+"""
+from flask import (Blueprint)
+from .lib.utils import (send_result)
+from ..lib.log import log_with
+from flask import g
+import logging
+from privacyidea.lib.applications import get_application_types
+
+
+log = logging.getLogger(__name__)
+
+
+application_blueprint = Blueprint('application_blueprint', __name__)
+
+
+@application_blueprint.route('/', methods=['GET'])
+@log_with(log)
+def get_applications():
+    """
+    returns a json dict of the available applications
+
+    **Example request**:
+
+    .. sourcecode:: http
+
+       GET /application HTTP/1.1
+       Host: example.com
+       Accept: application/json
+
+    **Example response**:
+
+    .. sourcecode:: http
+
+       HTTP/1.1 200 OK
+       Content-Type: application/json
+
+        {
+          "luks": {
+            "options": {
+              "slot": {
+                "type": "int"
+              },
+              "partition": {
+                "type": "str"
+              }
+            }
+          },
+          "ssh": {
+            "options": {
+              "user": {
+                "type": "str"
+              }
+            }
+          },
+          "otherapplication": {
+            "options": {
+              "optionA": {
+                "type": "int",
+                "required": true
+              }
+            }
+          }
+        }
+    """
+    res = get_application_types()
+    g.audit_object.log({"success": True})
+    return send_result(res)

privacyidea/api/audit.py

@@ -0,0 +1,148 @@
+# http://www.privacyidea.org
+# (c) cornelius kölbel, privacyidea.org
+#
+# 2018-11-21 Cornelius Kölbel <cornelius.koelbel@netknights.it>
+#            Remove the audit log based statistics
+# 2016-12-20 Cornelius Kölbel <cornelius.koelbel@netknights.it>
+#            Restrict download to certain time
+# 2015-07-16 Cornelius Kölbel, <cornelius.koelbel@netknights.it>
+#            Add statistics endpoint
+# 2015-01-20 Cornelius Kölbel, <cornelius@privacyidea.org>
+#            Complete rewrite during flask migration
+#            Try to provide REST API
+#
+# This code is free software; you can redistribute it and/or
+# modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
+# License as published by the Free Software Foundation; either
+# version 3 of the License, or any later version.
+#
+# This code is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU AFFERO GENERAL PUBLIC LICENSE for more details.
+#
+# You should have received a copy of the GNU Affero General Public
+# License along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+"""This is the audit REST API that can be used to search the audit log.
+It only provides the method
+
+  GET /audit
+"""
+from flask import (Blueprint, request, current_app, stream_with_context)
+from .lib.utils import (send_result, send_file)
+from ..api.lib.prepolicy import (prepolicy, check_base_action, auditlog_age,
+                                 allowed_audit_realm, hide_audit_columns)
+from ..api.auth import admin_required
+from ..lib.policies.actions import PolicyAction
+from flask import g
+import logging
+from ..lib.audit import search, getAudit
+from privacyidea.lib.utils import parse_timedelta
+
+log = logging.getLogger(__name__)
+
+audit_blueprint = Blueprint('audit_blueprint', __name__)
+
+
+@audit_blueprint.route('/', methods=['GET'])
+@prepolicy(check_base_action, request, PolicyAction.AUDIT)
+@prepolicy(allowed_audit_realm, request, PolicyAction.AUDIT)
+@prepolicy(auditlog_age, request)
+@prepolicy(hide_audit_columns, request)
+def search_audit():
+    """
+    return a paginated list of audit entries.
+
+    Params can be passed as key-value-pairs.
+
+    :httpparam timelimit: A timelimit, that limits the recent audit entries.
+        This param gets overwritten by a policy auditlog_age. Can be 1d, 1m, 1h.
+
+    **Example request**:
+
+    .. sourcecode:: http
+
+       GET /audit?realm=realm1 HTTP/1.1
+       Host: example.com
+       Accept: application/json
+
+    **Example response**:
+
+    .. sourcecode:: http
+
+       HTTP/1.1 200 OK
+       Content-Type: application/json
+
+        {
+          "id": 1,
+          "jsonrpc": "2.0",
+          "result": {
+            "status": true,
+            "value": [
+              {
+                 "serial": "....",
+                 "missing_line": "..."
+              }
+            ]
+          },
+          "version": "privacyIDEA unknown"
+        }
+    """
+    audit_dict = search(current_app.config, request.all_data)
+    g.audit_object.log({'success': True})
+
+    return send_result(audit_dict)
+
+
+@audit_blueprint.route('/<csvfile>', methods=['GET'])
+@prepolicy(check_base_action, request, PolicyAction.AUDIT_DOWNLOAD)
+@prepolicy(auditlog_age, request)
+@admin_required
+def download_csv(csvfile=None):
+    """
+    Download the audit entry as CSV file.
+
+    Params can be passed as key-value-pairs.
+
+    **Example request**:
+
+    .. sourcecode:: http
+
+       GET /audit/audit.csv?realm=realm1 HTTP/1.1
+       Host: example.com
+       Accept: text/csv
+
+    **Example response**:
+
+    .. sourcecode:: http
+
+       HTTP/1.1 200 OK
+       Content-Type: text/csv
+
+        {
+          "id": 1,
+          "jsonrpc": "2.0",
+          "result": {
+            "status": true,
+            "value": [
+              {
+                 "serial": "....",
+                 "missing_line": "..."
+              }
+            ]
+          },
+          "version": "privacyIDEA unknown"
+        }
+    """
+    audit = getAudit(current_app.config)
+    g.audit_object.log({'success': True})
+    param = request.all_data
+    if "timelimit" in param:
+        timelimit = parse_timedelta(param["timelimit"])
+        del param["timelimit"]
+    else:
+        timelimit = None
+    return send_file(stream_with_context(audit.csv_generator(param=param,
+                                                             timelimit=timelimit)),
+                     csvfile)