Module glopy :: Class Credential
[hide private]

Class Credential

object --+
         |
        Credential

Class for loading and verifying X509 credentials. A credential must contain a certificate, and may optionally contain a private key and/or additional certificates making up the trust chain. The typical example is a proxy credential, which will contain a proxy certificate, a private key, and the end entity certificate that issued the proxy. Some methods apply only if a chain and/or private key is present, and will raise an error if those fields are not present. The functionality is implemented using the credential library from globus toolkit. The constructor takes an optional string parameter, which is equivalent to using load_cert. If not string is passed, one of the load methods must be called before using any of the methods are called, otherwise an exception is thrown.

Instance Methods [hide private]
 
__init__(...)
x.__init__(...) initializes x; see x.__class__.__doc__ for signature
a new object with type S, a subtype of T
__new__(T, S, ...)
 
check_cert_issuer(...)
Check that the main certificate is signed by the public key of the first certificate in the chain (it's issuer).
 
check_private_key(...)
Check that the private key matches the public key in the main certificate.
 
get_chain_length(...)
Get the length of the certificate chain, not including the main certificate.
 
get_identity(...)
Get the identity subject of the certificate, as a string in openssl format.
 
get_issuer(...)
Get the issuer of the certificate, as a string in openssl format.
 
get_key_size(...)
Get the key size in bits.
 
get_lifetime(...)
Get the remaining valid lifetime of the certificate in seconds.
 
get_not_after(...)
Get the time the credential expires, as a datetime object in UTC.
 
get_not_before(...)
Get the not before time of the credential, as a datetime object in UTC.
 
get_subject(...)
Get the subject of the certificate, as a string in openssl format.
 
has_private_key(...)
True if a credential has been loaded and includes a private key.
 
load_cert(...)
Load a certificate (with optional chain) from a PEM string.
 
load_cert_and_key(...)
Load a certificate and private key (with optional chain) from a PEM string.
 
load_cert_and_key_file(...)
Load a certificate and private key (with optional chain) from a file, in PEM format.
 
load_cert_file(...)
Load a certificate (with optional chain) from a file in PEM format.
 
validate(...)
Determine if the certificate is valid using the GT configured CA certificate directory.

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

__init__(...)
(Constructor)

 

x.__init__(...) initializes x; see x.__class__.__doc__ for signature

Overrides: object.__init__

__new__(T, S, ...)

 
Returns: a new object with type S, a subtype of T
Overrides: object.__new__

check_cert_issuer(...)

 

Check that the main certificate is signed by the public key of the first certificate in the chain (it's issuer). Does not check signing policies. Returns None on success, raises glopy.error on failure.

check_private_key(...)

 

Check that the private key matches the public key in the main certificate. Only works on credentials containing a private key. Returns None on success, raises glopy.error on failure.

get_identity(...)

 

Get the identity subject of the certificate, as a string in openssl format. This is the subject with proxy CNs removed, and should usually be used instead of the subject.

get_not_after(...)

 

Get the time the credential expires, as a datetime object in UTC. This will be the smallest expire time of the main certificate and any certificates in the chain.

get_not_before(...)

 

Get the not before time of the credential, as a datetime object in UTC. This will be the largest not before time of the main certificate and any certificates in the chain.

validate(...)

 

Determine if the certificate is valid using the GT configured CA certificate directory. Signing policies are checked for each non-proxy link in the chain. Returns None on success, raises glopy.error on failure.