31 lines
1.6 KiB
Python
31 lines
1.6 KiB
Python
|
"""Enable possession proof for newly enrolled TOTP factors; never touch existing factors."""
|
||
|
|
import json,subprocess
|
||
|
|
def metadata(*args):
|
||
|
|
r=subprocess.run(['kubectl',*args,'-o','json'],capture_output=True,check=True,timeout=20)
|
||
|
|
return json.loads(r.stdout)['metadata']
|
||
|
|
assert metadata('get','ns','kube-system')['uid']=='a553c742-0115-43d4-99a4-a5ca56fe0786'
|
||
|
|
assert metadata('-n','mfa','get','deploy','privacyidea')['uid']=='58c7f96d-61cb-4dd4-bca2-54661c0ac375'
|
||
|
|
code='''import contextlib,io,json,logging
|
||
|
|
result={"success":False}
|
||
|
|
with contextlib.redirect_stdout(io.StringIO()),contextlib.redirect_stderr(io.StringIO()):
|
||
|
|
try:
|
||
|
|
logging.disable(logging.CRITICAL)
|
||
|
|
from privacyidea.app import create_app
|
||
|
|
from privacyidea.lib.policy import set_policy,PolicyClass
|
||
|
|
app=create_app(config_name="production",silent=True)
|
||
|
|
with app.app_context():
|
||
|
|
name="keycape-confirm-totp-enrollment"
|
||
|
|
set_policy(name=name,scope="enrollment",action="verify_enrollment=totp",realm="coulomb")
|
||
|
|
rows=PolicyClass().list_policies(name=name)
|
||
|
|
result={"success":len(rows)==1 and rows[0]["active"] and rows[0]["action"].get("verify_enrollment")=="totp","policy":name,"existing_factors_changed":False}
|
||
|
|
except Exception:pass
|
||
|
|
print(json.dumps(result))
|
||
|
|
raise SystemExit(0 if result["success"] else 1)
|
||
|
|
'''
|
||
|
|
r=subprocess.run(['kubectl','-n','mfa','exec','deployment/privacyidea','-c','privacyidea','--','python3','-c',code],capture_output=True,timeout=45)
|
||
|
|
try:result=json.loads(r.stdout)
|
||
|
|
except Exception:result={'success':False}
|
||
|
|
assert set(result)<={'success','policy','existing_factors_changed'}
|
||
|
|
print(json.dumps(result))
|
||
|
|
raise SystemExit(0 if result.get('success') else 1)
|