35 lines
1.5 KiB
Python
35 lines
1.5 KiB
Python
#!/usr/bin/env python
|
|
#
|
|
# tyr/tools/eval_tyr_identity.py - MCP Tool for verifying SPIFFE identities
|
|
#
|
|
import subprocess
|
|
|
|
|
|
def eval_tyr_identity(p: dict) -> dict:
|
|
"""Verifies the validity and properties of a SPIFFE SVID by querying the SPIRE server."""
|
|
spiffe_id = p.get("spiffe_id")
|
|
if not spiffe_id:
|
|
raise ValueError("Missing required parameter: 'spiffe_id'")
|
|
|
|
if not spiffe_id.startswith("spiffe://vauco.no/"):
|
|
return {"status": "FAIL", "reason": "Invalid SPIFFE ID format for trust domain 'vauco.no'."}
|
|
|
|
try:
|
|
# This assumes the spire-server binary is in the path or at this location
|
|
cmd = ["./spire-1.15.3/bin/spire-server",
|
|
"entry", "show", "-spiffeID", spiffe_id]
|
|
result = subprocess.run(cmd, capture_output=True,
|
|
text=True, check=True, timeout=10)
|
|
|
|
if "Found 1 entry" in result.stdout:
|
|
# A more robust check would parse the TTL and other details
|
|
return {"status": "PASS", "spiffe_id": spiffe_id, "message": "Entry found and is active."}
|
|
else:
|
|
return {"status": "FAIL", "spiffe_id": spiffe_id, "reason": "SPIFFE ID not found or has no active entry."}
|
|
|
|
except subprocess.CalledProcessError:
|
|
# This handles cases where the entry is not found, as spire-server returns a non-zero exit code
|
|
return {"status": "FAIL", "spiffe_id": spiffe_id, "reason": "SPIRE server error: Entry not found."}
|
|
except Exception as e:
|
|
return {"status": "ERROR", "message": str(e)}
|