22

✏️ Editing: yubico.py

"""
Provide authentication using YubiKey.

.. versionadded:: 2015.5.0

:depends: yubico-client Python module

To get your YubiKey API key you will need to visit the website below.

https://upgrade.yubico.com/getapikey/

The resulting page will show the generated Client ID (aka AuthID or API ID)
and the generated API key (Secret Key). Make a note of both and use these
two values in your /etc/salt/master configuration.

/etc/salt/master

.. code-block:: yaml

yubico_users:
      damian:
        id: 12345
        key: ABCDEFGHIJKLMNOPQRSTUVWXYZ

.. code-block:: yaml

external_auth:
      yubico:
        damian:
          - test.*

Please wait five to ten minutes after generating the key before testing so that
the API key will be updated on all the YubiCloud servers.

"""

import logging

log = logging.getLogger(__name__)

try:
    from yubico_client import Yubico, yubico_exceptions

HAS_YUBICO = True
except ImportError:
    HAS_YUBICO = False

def __get_yubico_users(username):
    """
    Grab the YubiKey Client ID & Secret Key
    """
    user = {}

try:
        if __opts__["yubico_users"].get(username, None):
            (user["id"], user["key"]) = list(
                __opts__["yubico_users"][username].values()
            )
        else:
            return None
    except KeyError:
        return None

return user

def auth(username, password):
    """
    Authenticate against yubico server
    """
    _cred = __get_yubico_users(username)

client = Yubico(_cred["id"], _cred["key"])

try:
        return client.verify(password)
    except yubico_exceptions.StatusCodeError as e:
        log.info("Unable to verify YubiKey `%s`", e)
        return False

def groups(username, *args, **kwargs):
    return False

if __name__ == "__main__":
    __opts__ = {"yubico_users": {"damian": {"id": "12345", "key": "ABC123"}}}

if auth("damian", "OPT"):
        print("Authenticated")
    else:
        print("Failed to authenticate")

MR SKB