1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
"""
synta.krb5 — Kerberos V5 ASN.1 types backed by synta-krb5.
This module is implemented in Rust (``synta-krb5`` / ``synta-python``) and
registered as a submodule of the ``synta._synta`` extension during
``import synta``. It is available immediately after::
import synta
Usage::
import synta.krb5
# Encode a PKINIT TGT service principal:
name = synta.krb5.Krb5PrincipalName(
realm="EXAMPLE.COM",
name_type=synta.krb5.NT_SRV_INST,
components=["krbtgt", "EXAMPLE.COM"],
)
# OID for the OtherName: synta.krb5.KRB5_PRINCIPAL_NAME_OID (1.3.6.1.5.2.2)
der_bytes = name.to_der() # DER SEQUENCE bytes for OtherName.value
# Decode from DER:
parsed = synta.krb5.Krb5PrincipalName.from_der(der_bytes)
print(parsed.realm) # "EXAMPLE.COM"
print(parsed.name_type) # 2 (NT_SRV_INST)
print(parsed.components) # ["krbtgt", "EXAMPLE.COM"]
OID constant:
.. data:: KRB5_PRINCIPAL_NAME_OID
:type: synta.ObjectIdentifier
OID for the ``KRB5PrincipalName`` OtherName SAN type (1.3.6.1.5.2.2,
id-pkinit-san, RFC 4556 §3.2.2). Use this as the OID argument when
constructing an ``OtherName`` extension for PKINIT certificates.
Principal name type constants (RFC 4120 §6.2):
.. data:: NT_UNKNOWN
:type: int
Name type not known (0).
.. data:: NT_PRINCIPAL
:type: int
Just a name of the principal as an identifier (1).
.. data:: NT_SRV_INST
:type: int
Service and unique instance, e.g. ``krbtgt`` (2).
.. data:: NT_SRV_HST
:type: int
Service with host name as instance, e.g. ``host`` (3).
.. data:: NT_SRV_XHST
:type: int
Service with host as remaining components (4).
.. data:: NT_UID
:type: int
Unique ID (5).
.. data:: NT_X500_PRINCIPAL
:type: int
Encoded X.509 Distinguished Name (6).
.. data:: NT_SMTP_NAME
:type: int
Name in the form of an SMTP email address (7).
.. data:: NT_ENTERPRISE
:type: int
Enterprise name, typically a UPN (RFC 6806, value 10).
.. data:: NT_WELLKNOWN
:type: int
Well-known principal, used for anonymous authentication (RFC 8062, value 11).
.. data:: NT_SRV_HST_DOMAIN
:type: int
Host-based service principal, Windows MS-SFU style (12).
"""
# This file is a documentation and IDE-stub only. The live module object for
# ``synta.krb5`` is the Rust module registered in sys.modules["synta.krb5"]
# by synta-python's _synta initialiser. Python never executes this file at
# runtime because sys.modules["synta.krb5"] is already populated before any
# import machinery would look for a .py file.