(credentials, sock_info)
Authenticate using SCRAM-SHA-1.
Authenticate using SCRAM-SHA-1.
Authenticate using SCRAM - SHA - 1 .
def _authenticate_scram_sha1(credentials, sock_info):
    """Authenticate using SCRAM-SHA-1."""
    username = credentials.username
    password = credentials.password
    source = credentials.source

    # Make local
    _hmac = hmac.HMAC
    _sha1 = sha1

    user = username.encode("utf-8").replace(b"=", b"=3D").replace(b",", b"=2C")
    nonce = standard_b64encode(
        (("%s" % (SystemRandom().random(),))[2:]).encode("utf-8"))
    first_bare = b"n=" + user + b",r=" + nonce

    cmd = SON([('saslStart', 1),
               ('mechanism', 'SCRAM-SHA-1'),
               ('payload', Binary(b"n,," + first_bare)),
               ('autoAuthorize', 1)])
    res = sock_info.command(source, cmd)

    server_first = res['payload']
    parsed = _parse_scram_response(server_first)
    iterations = int(parsed[b'i'])
    salt = parsed[b's']
    rnonce = parsed[b'r']
    if not rnonce.startswith(nonce):
        raise OperationFailure("Server returned an invalid nonce.")

    without_proof = b"c=biws,r=" + rnonce
    salted_pass = _hi(_password_digest(username, password).encode("utf-8"),
                      standard_b64decode(salt),
                      iterations)
    client_key = _hmac(salted_pass, b"Client Key", _sha1).digest()
    stored_key = _sha1(client_key).digest()
    auth_msg = b",".join((first_bare, server_first, without_proof))
    client_sig = _hmac(stored_key, auth_msg, _sha1).digest()
    client_proof = b"p=" + standard_b64encode(_xor(client_key, client_sig))
    client_final = b",".join((without_proof, client_proof))

    server_key = _hmac(salted_pass, b"Server Key", _sha1).digest()
    server_sig = standard_b64encode(
        _hmac(server_key, auth_msg, _sha1).digest())

    cmd = SON([('saslContinue', 1),
               ('conversationId', res['conversationId']),
               ('payload', Binary(client_final))])
    res = sock_info.command(source, cmd)

    parsed = _parse_scram_response(res['payload'])
    if not compare_digest(parsed[b'v'], server_sig):
        raise OperationFailure("Server returned an invalid signature.")

    # Depending on how it's configured, Cyrus SASL (which the server uses)
    # requires a third empty challenge.
    if not res['done']:
        cmd = SON([('saslContinue', 1),
                   ('conversationId', res['conversationId']),
                   ('payload', Binary(b''))])
        res = sock_info.command(source, cmd)
        if not res['done']:
            raise OperationFailure('SASL conversation failed to complete.')
def _authenticate_scram_sha1 ( credentials , sock_info ) : username = credentials . username password = credentials . password source = credentials . source # Make local _hmac = hmac . HMAC _sha1 = sha1 user = username . encode ( "utf-8" ) . replace ( b"=" , b"=3D" ) . replace ( b"," , b"=2C" ) nonce = standard_b64encode ( ( ( "%s" % ( SystemRandom ( ) . random ( ) , ) ) [ 2 : ] ) . encode ( "utf-8" ) ) first_bare = b"n=" + user + b",r=" + nonce cmd = SON ( [ ( 'saslStart' , 1 ) , ( 'mechanism' , 'SCRAM-SHA-1' ) , ( 'payload' , Binary ( b"n,," + first_bare ) ) , ( 'autoAuthorize' , 1 ) ] ) res = sock_info . command ( source , cmd ) server_first = res [ 'payload' ] parsed = _parse_scram_response ( server_first ) iterations = int ( parsed [ b'i' ] ) salt = parsed [ b's' ] rnonce = parsed [ b'r' ] if not rnonce . startswith ( nonce ) : raise OperationFailure ( "Server returned an invalid nonce." ) without_proof = b"c=biws,r=" + rnonce salted_pass = _hi ( _password_digest ( username , password ) . encode ( "utf-8" ) , standard_b64decode ( salt ) , iterations ) client_key = _hmac ( salted_pass , b"Client Key" , _sha1 ) . digest ( ) stored_key = _sha1 ( client_key ) . digest ( ) auth_msg = b"," . join ( ( first_bare , server_first , without_proof ) ) client_sig = _hmac ( stored_key , auth_msg , _sha1 ) . digest ( ) client_proof = b"p=" + standard_b64encode ( _xor ( client_key , client_sig ) ) client_final = b"," . join ( ( without_proof , client_proof ) ) server_key = _hmac ( salted_pass , b"Server Key" , _sha1 ) . digest ( ) server_sig = standard_b64encode ( _hmac ( server_key , auth_msg , _sha1 ) . digest ( ) ) cmd = SON ( [ ( 'saslContinue' , 1 ) , ( 'conversationId' , res [ 'conversationId' ] ) , ( 'payload' , Binary ( client_final ) ) ] ) res = sock_info . command ( source , cmd ) parsed = _parse_scram_response ( res [ 'payload' ] ) if not compare_digest ( parsed [ b'v' ] , server_sig ) : raise OperationFailure ( "Server returned an invalid signature." ) # Depending on how it's configured, Cyrus SASL (which the server uses) # requires a third empty challenge. if not res [ 'done' ] : cmd = SON ( [ ( 'saslContinue' , 1 ) , ( 'conversationId' , res [ 'conversationId' ] ) , ( 'payload' , Binary ( b'' ) ) ] ) res = sock_info . command ( source , cmd ) if not res [ 'done' ] : raise OperationFailure ( 'SASL conversation failed to complete.' )