# Authentication modules

Modern, adaptable authentication machinery.

Replaces certain parts of `SSHClient`. For a concrete implementation, see the `OpenSSHAuthStrategy` class in Fabric.

class paramiko.auth_strategy.AuthSource(username)

  Some SSH authentication source, such as a password, private key, or agent.

  See subclasses in this module for concrete implementations.

  All implementations must accept at least a `username` (`str`) kwarg.

  __init__(username)
  __repr__()

    Return repr(self).

  authenticate(transport)

    Perform authentication.

  __weakref__

    list of weak references to the object (if defined)

class paramiko.auth_strategy.NoneAuth(username)

  Auth type “none”, ie https://www.rfc-editor.org/rfc/rfc4252#section-5.2 .

  authenticate(transport)

    Perform authentication.

class paramiko.auth_strategy.Password(username, password_getter)

  Password authentication.

  Parameters

    password_getter (callable) –

    A lazy callable that should return a `str` password value at authentication time, such as a `functools.partial` wrapping `getpass.getpass`, an API call to a secrets store, or similar.

    If you already know the password at instantiation time, you should simply use something like `lambda: "my literal"` (for a literal, but also, shame on you!) or `lambda: variable_name` (for something stored in a variable).

  __init__(username, password_getter)
  __repr__()

    Return repr(self).

  authenticate(transport)

    Perform authentication.

class paramiko.auth_strategy.PrivateKey(username)

  Essentially a mixin for private keys.

  Knows how to auth, but leaves key material discovery/loading/decryption to subclasses.

  Subclasses must ensure that they’ve set `self.pkey` to a decrypted `PKey` instance before calling `super().authenticate`; typically either in their `__init__`, or in an overridden `authenticate` prior to its `super` call.

  authenticate(transport)

    Perform authentication.

class paramiko.auth_strategy.InMemoryPrivateKey(username, pkey)

  An in-memory, decrypted `PKey` object.

  __init__(username, pkey)
  __repr__()

    Return repr(self).

class paramiko.auth_strategy.OnDiskPrivateKey(username, source, path, pkey)

  Some on-disk private key that needs opening and possibly decrypting.

  Parameters

    - source (str) – String tracking where this key’s path was specified; should be one of `"ssh-config"`, `"python-config"`, or `"implicit-home"`.

    - path (Path) – The filesystem path this key was loaded from.

    - pkey (PKey) – The `PKey` object this auth source uses/represents.

  __init__(username, source, path, pkey)
  __repr__()

    Return repr(self).

class paramiko.auth_strategy.SourceResult(source, result)
  __getnewargs__()

    Return self as a plain tuple. Used by copy and pickle.

  static __new__(_cls, source, result)

    Create new instance of SourceResult(source, result)

  __repr__()

    Return a nicely formatted representation string

  property result

    Alias for field number 1

  property source

    Alias for field number 0

class paramiko.auth_strategy.AuthResult(strategy, *args, **kwargs)

  Represents a partial or complete SSH authentication attempt.

  This class conceptually extends `AuthStrategy` by pairing the former’s authentication sources with the results of trying to authenticate with them.

  `AuthResult` is a (subclass of) `list` of `namedtuple`, which are of the form `namedtuple('SourceResult', 'source', 'result')` (where the `source` member is an `AuthSource` and the `result` member is either a return value from the relevant `Transport` method, or an exception object).

  Note

  Transport auth method results are always themselves a `list` of “next allowable authentication methods”.

  In the simple case of “you just authenticated successfully”, it’s an empty list; if your auth was rejected but you’re allowed to try again, it will be a list of string method names like `pubkey` or `password`.

  The `__str__` of this class represents the empty-list scenario as the word `success`, which should make reading the result of an authentication session more obvious to humans.

  Instances also have a `strategy` attribute referencing the `AuthStrategy` which was attempted.

  __init__(strategy, *args, **kwargs)
  __str__()

    Return str(self).

  __weakref__

    list of weak references to the object (if defined)

exception paramiko.auth_strategy.AuthFailure(result)

  Basic exception wrapping an `AuthResult` indicating overall auth failure.

  Note that `AuthFailure` descends from `AuthenticationException` but is generally “higher level”; the latter is now only raised by individual `AuthSource` attempts and should typically only be seen by users when encapsulated in this class. It subclasses `AuthenticationException` primarily for backwards compatibility reasons.

  __init__(result)
  __str__()

    Return str(self).

class paramiko.auth_strategy.AuthStrategy(ssh_config)

  This class represents one or more attempts to auth with an SSH server.

  By default, subclasses must at least accept an `ssh_config` (`SSHConfig`) keyword argument, but may opt to accept more as needed for their particular strategy.

  __init__(ssh_config)
  get_sources()

    Generator yielding `AuthSource` instances, in the order to try.

    This is the primary override point for subclasses: you figure out what sources you need, and `yield` them.

    Subclasses _of_ subclasses may find themselves wanting to do things like filtering or discarding around a call to `super`.

  authenticate(transport)

    Handles attempting `AuthSource` instances yielded from `get_sources`.

    You normally won’t need to override this, but it’s an option for advanced users.

  __weakref__

    list of weak references to the object (if defined)

`AuthHandler`

class paramiko.auth_handler.AuthHandler(transport)

  Internal class to handle the mechanics of authentication.

  __init__(transport)
  auth_interactive(username, handler, event, submethods='')

    response_list = handler(title, instructions, prompt_list)

  __weakref__

    list of weak references to the object (if defined)

class paramiko.auth_handler.GssapiWithMicAuthHandler(delegate, sshgss)

  A specialized Auth handler for gssapi-with-mic

  During the GSSAPI token exchange we need a modified dispatch table, because the packet type numbers are not unique.

  __init__(delegate, sshgss)
  __weakref__

    list of weak references to the object (if defined)

class paramiko.auth_handler.AuthOnlyHandler(transport)

  AuthHandler, and just auth, no service requests!

  New in version 3.2.

  send_auth_request(username, method, finish_message=None)

    Submit a userauth request message & wait for response.

    Performs the transport message send call, sets self.auth_event, and will lock-n-block as necessary to both send, and wait for response to, the USERAUTH_REQUEST.

    Most callers will want to supply a callback to `finish_message`, which accepts a Message `m` and may call mutator methods on it to add more fields.

  auth_interactive(username, handler, submethods='')

    response_list = handler(title, instructions, prompt_list)