PyKMIP 0.4.1

Client

There are two implementations of the KMIP client. The first, kmip.services.kmip_client.KMIPProxy, is the original client and provides support for the following operations:

• Create

• CreateKeyPair

• Register

• Locate

• Get

• GetAttributeList

• Activate

• Revoke

• Destroy

• Query

• DiscoverVersions

The second client, kmip.pie.client.ProxyKmipClient, wraps the original KMIPProxy and provides a simpler interface. It provides support for the following operations:

• Create

• CreateKeyPair

• Register

• Get

• GetAttributeList

• Destroy

For examples of how to create and use the different clients, see the scripts in kmip/demos.

[client]
host=127.0.0.1
port=5696
keyfile=/path/to/key/file
certfile=/path/to/cert/file
cert_reqs=CERT_REQUIRED
ssl_version=PROTOCOL_SSLv23
ca_certs=/path/to/ca/cert/file
do_handshake_on_connect=True
suppress_ragged_eofs=True
username=user
password=password

client = ProxyKmipClient(
    hostname='127.0.0.1',
    port=5696,
    cert='/path/to/cert/file/',
    key='/path/to/key/file/',
    ca='/path/to/ca/cert/file/',
    ssl_version='PROTOCOL_SSLv23',
    username='user',
    password='password',
    config='client')

Server

In addition to the KMIP clients, PyKMIP provides a basic software implementation of a KMIP server, kmip.services.kmip_server.KMIPServer. However, the server is intended for use only in testing and demonstration environments. The server is not intended to be a substitute for a secure, hardware-based key management appliance. The PyKMIP client should be used for operational purposes only with a hardware-based KMIP server.

The KMIP server provides basic support for the following operations:

• Create

• Register

• Locate

• Get

• Destroy

[server]
host=127.0.0.1
port=5696
keyfile=/path/to/key/file
certfile=/path/to/cert/file
cert_reqs=CERT_NONE
ssl_version=PROTOCOL_SSLv23
ca_certs=/path/to/ca/cert/file
do_handshake_on_connect=True
suppress_ragged_eofs=True

Roadmap

The development plan for PyKMIP follows the requirements for the following KMIP profiles. The foundation for symmetric and asymmetric key operation support is already built into the library.

Client profiles:

• Basic Baseline Client KMIP Profile

• Basic Symmetric Key Store Client KMIP Profile

• Basic Symmetric Key Foundry Client KMIP Profile

• Basic Asymmetric Key Store Client KMIP Profile

• Basic Asymmetric Key Foundry Client KMIP Profile

Server profiles:

• Basic Discover Versions Server KMIP Profile

• Basic Baseline Server KMIP Profile

• Basic Symmetric Key Store and Server KMIP Profile

• Basic Symmetric Key Foundry and Server KMIP Profile

• Basic Asymmetric Key Store Server KMIP Profile

• Basic Asymmetric Key Foundry and Server KMIP Profile

Testing

The PyKMIP test suite is composed of two parts, a unit test suite and an integration test suite that runs various tests against instantiations of the software KMIP server and real KMIP appliances. The tests are managed by a combination of the tox, pytest, and flake8 libraries.

There are several ways to run different versions of the tests. To run, use one of the following commands in the PyKMIP root directory.

To run all of the unit tests:

$ tox

To run the Python syntax and format compliance tests:

$ tox -e pep8

To run the unit test suite against Python 2.7:

$ tox -e py27

The integration tests require a configuration flag whose value corresponds to the name of a client configuration section in the kmipconfig.ini configuration file. See the Usage section for more information.

To run the integration test suite with a specific configuration setup:

$ tox -e integration -- --config <section-name>

For more information and a list of supported tox environments, see tox.ini in the PyKMIP root directory.