def activate_session(self, username=None, password=None, certificate=None):
"""
Activate session using either username and password or private_key
"""
params = ua.ActivateSessionParameters()
challenge = b""
if self.security_policy.server_certificate is not None:
challenge += self.security_policy.server_certificate
if self._server_nonce is not None:
challenge += self._server_nonce
params.ClientSignature.Algorithm = b"http://www.w3.org/2000/09/xmldsig#rsa-sha1"
params.ClientSignature.Signature = self.security_policy.asymmetric_cryptography.signature(
challenge)
params.LocaleIds.append("en")
if not username and not certificate:
params.UserIdentityToken = ua.AnonymousIdentityToken()
params.UserIdentityToken.PolicyId = self.server_policy_id(
ua.UserTokenType.Anonymous, b"anonymous")
elif certificate:
params.UserIdentityToken = ua.X509IdentityToken()
params.UserIdentityToken.PolicyId = self.server_policy_id(
ua.UserTokenType.Certificate, b"certificate_basic256")
params.UserIdentityToken.CertificateData = uacrypto.der_from_x509(
certificate)
# specs part 4, 5.6.3.1: the data to sign is created by appending
# the last serverNonce to the serverCertificate
sig = uacrypto.sign_sha1(self.user_private_key, challenge)
params.UserTokenSignature = ua.SignatureData()
params.UserTokenSignature.Algorithm = b"http://www.w3.org/2000/09/xmldsig#rsa-sha1"
params.UserTokenSignature.Signature = sig
else:
params.UserIdentityToken = ua.UserNameIdentityToken()
params.UserIdentityToken.UserName = username
policy_uri = self.server_policy_uri(ua.UserTokenType.UserName)
if not policy_uri or policy_uri == security_policies.POLICY_NONE_URI:
# see specs part 4, 7.36.3: if the token is NOT encrypted,
# then the password only contains UTF-8 encoded password
# and EncryptionAlgorithm is null
if self.server_url.password:
self.logger.warning("Sending plain-text password")
params.UserIdentityToken.Password = password
params.UserIdentityToken.EncryptionAlgorithm = ''
elif self.server_url.password:
pubkey = uacrypto.x509_from_der(
self.security_policy.server_certificate).public_key()
# see specs part 4, 7.36.3: if the token is encrypted, password
# shall be converted to UTF-8 and serialized with server nonce
passwd = bytes(password, "utf8")
if self._server_nonce is not None:
passwd += self._server_nonce
etoken = ua.pack_bytes(passwd)
data, uri = security_policies.encrypt_asymmetric(
pubkey, etoken, policy_uri)
params.UserIdentityToken.Password = data
params.UserIdentityToken.EncryptionAlgorithm = uri
params.UserIdentityToken.PolicyId = self.server_policy_id(
ua.UserTokenType.UserName, b"username_basic256")
return self.uaclient.activate_session(params)
def test_extension_object(self):
obj = ua.UserNameIdentityToken()
obj.UserName = "******"
obj.Password = b"pass"
obj2 = ua.extensionobject_from_binary(ua.utils.Buffer(extensionobject_to_binary(obj)))
self.assertEqual(type(obj), type(obj2))
self.assertEqual(obj.UserName, obj2.UserName)
self.assertEqual(obj.Password, obj2.Password)
v1 = ua.Variant(obj)
v2 = ua.Variant.from_binary(ua.utils.Buffer(v1.to_binary()))
self.assertEqual(type(v1), type(v2))
self.assertEqual(v1.VariantType, v2.VariantType)
def _add_user_auth(self, params, username, password):
params.UserIdentityToken = ua.UserNameIdentityToken()
params.UserIdentityToken.UserName = username
policy_uri = self.server_policy_uri(ua.UserTokenType.UserName)
if not policy_uri or policy_uri == security_policies.POLICY_NONE_URI:
# see specs part 4, 7.36.3: if the token is NOT encrypted,
# then the password only contains UTF-8 encoded password
# and EncryptionAlgorithm is null
if self._password:
_logger.warning("Sending plain-text password")
params.UserIdentityToken.Password = password.encode('utf8')
params.UserIdentityToken.EncryptionAlgorithm = None
elif self._password:
data, uri = self._encrypt_password(password, policy_uri)
params.UserIdentityToken.Password = data
params.UserIdentityToken.EncryptionAlgorithm = uri
params.UserIdentityToken.PolicyId = self.server_policy_id(ua.UserTokenType.UserName, "username_basic256")
def activate_session(self, username=None, password=None, certificate=None):
"""
Activate session using either username and password or private_key
"""
params = ua.ActivateSessionParameters()
challenge = self.security_policy.server_certificate + self._server_nonce
params.ClientSignature.Algorithm = b"http://www.w3.org/2000/09/xmldsig#rsa-sha1"
params.ClientSignature.Signature = self.security_policy.asymmetric_cryptography.signature(
challenge)
params.LocaleIds.append("en")
if not username and not certificate:
params.UserIdentityToken = ua.AnonymousIdentityToken()
params.UserIdentityToken.PolicyId = self.server_policy_id(
ua.UserTokenType.Anonymous, b"anonymous")
elif certificate:
params.UserIdentityToken = ua.X509IdentityToken()
params.UserIdentityToken.PolicyId = self.server_policy_id(
ua.UserTokenType.Certificate, b"certificate_basic256")
params.UserIdentityToken.CertificateData = uacrypto.der_from_x509(
certificate)
# specs part 4, 5.6.3.1: the data to sign is created by appending
# the last serverNonce to the serverCertificate
sig = uacrypto.sign_sha1(self.user_private_key, challenge)
params.UserTokenSignature = ua.SignatureData()
params.UserTokenSignature.Algorithm = b"http://www.w3.org/2000/09/xmldsig#rsa-sha1"
params.UserTokenSignature.Signature = sig
else:
params.UserIdentityToken = ua.UserNameIdentityToken()
params.UserIdentityToken.UserName = username
if self.server_url.password:
pubkey = uacrypto.x509_from_der(
self.security_policy.server_certificate).public_key()
# see specs part 4, 7.36.3: if the token is encrypted, password
# shall be converted to UTF-8 and serialized with server nonce
etoken = ua.pack_bytes(
bytes(password, "utf8") + self._server_nonce)
#data = uacrypto.encrypt_basic256(pubkey, etoken)
data = uacrypto.encrypt_rsa_oaep(pubkey, etoken)
params.UserIdentityToken.Password = data
params.UserIdentityToken.PolicyId = self.server_policy_id(
ua.UserTokenType.UserName, b"username_basic256")
params.UserIdentityToken.EncryptionAlgorithm = 'http://www.w3.org/2001/04/xmlenc#rsa-oaep'
return self.bclient.activate_session(params)