linotp.lib.security.provider module

The security provider is a dynamic handler for security relevant tasks like random, crypt, decrypt, sign

class linotp.lib.security.provider.SecurityProvider

Bases: object

the security provider is the singleton in the server who provides the security modules to run security relevant methods

• read the hsm configurations

• set up a pool of hsm modules

• bind a hsm to one session

• free the hsm from session after usage

the thread id is used as session identifier

createHSMPool(hsm_id=None, *args, **kw)

Setup the pool of security module connections

Parameters:

hsm_id – The id of the hsm provider which must exist in the hsm config,

if None the one from the config will be used

Returns:

The created pool (list) of hsm connections

dropSecurityModule(hsm_id=None, sessionId=None)

Searches in the hsm pool and finds the hsm connection allocated by the thread (sessionId) and makes that hsm connection free

Parameters:

• hsm_id – the identifier of the hsm pool which is stated in the hsm config

• sessionId – the thread id

Returns:

expected to be True if it succeeds to drop, false if it fails

getSecurityModule(hsm_id=None, sessionId=None)

Allocate a security module for the sessionId

Parameters:

hsm_id – Specifies from which pool to choose. It will use the

activeOne if it’s not specified :param sessionId: Specifies the threadId which will be used for the allocation of the hsm connection

Returns:

The allocated hsm connection

get_config_entries(config_name)

Parameters:

names – list of config entries by modulename

Returns:

dict

loadSecurityModule(module_id=None)

return the specified security module

Parameters:

id (String or None) – identifier for the security module (from the configuration)

Returns:

None or the created object

Return type:

security module

load_config(config)

load the security modules configuration

setupModule(hsm_id, config=None)

setupModule is called during runtime to define the config parameters like password or connection strings