https://openziti.io/openziti-python-sdk-introduction

Menu

[svg]OpenZiti.ioOpenZiti.io

[svg]OpenZiti.ioOpenZiti.io

HomeAbout ZitiQuickStartDocsNewsletterMembers
     

OpenZiti Python SDK: Introduction

[svg]Eugene Kobyakov's photoEugene Kobyakov's photo
Eugene Kobyakov
*Sep 20, 2022*

3 min read

[svg]OpenZiti Python SDK: IntroductionOpenZiti Python SDK:
Introduction

Subscribe to our newsletter and never miss any upcoming articles

[                    ]
Subscribe
Play this article
Your browser does not support the audio element.SPEED1X

Table of contents

  * Ziti Python SDK: Intro
      + Setup
      + Acquiring SDK
      + Basic Usage
          o Ziti identity enrollment
          o Open connection to Ziti service
          o Host(serve) Ziti service
      + It's 2022: WDIMMOS*?!!
          o Client Side
          o Server Side
      + Next Steps

Ziti Python SDK: Intro

OpenZiti project adds security layers that make your service
available without exposing incoming ports, provides identity-specific
end-to-end encryption, masks your network traffic protocols/ports,
and allows developers to be more agile and secure than ever in all
networking scenarios.

In our previous posts we introduced the concept of Zitification --
taking an app and changing it to use secure, zero-trust, overlay
network -- and shared few examples we developed internally.

This article will show how to zitify your Python applications with
minor code changes. Ziggy Loves Python.jpg

Setup

There are several ways to get started with OpenZiti.

  * follow instructions from previous posts
  * read quickstart docs
  * and even play in our sandbox/ZEDS -- fastest way to start. Ziti
    Edge Developer Sandbox(ZEDS) hosts a multi-tenant Ziti network.

Acquiring SDK

OpenZiti Python SDK is published to Python Package Index(PyPI) so
just go ahead with standard install, or add it to your application's
requirements.txt

$ pip install openziti

Basic Usage

In the following code examples the following is assumed (read more
about Ziti identities and services):

  * id.jwt - enrollment token file
  * id.json - ziti identity file
  * best-service-ever - name of the ziti service

Ziti identity enrollment

$ python -m openziti enroll --jwt id.jwt --identity id.json

Open connection to Ziti service

import openziti

# load ziti context, provide full path to identity file if needed
ztx = openziti.load('id.json')

conn = ztx.connect('best-service-ever')

# do cool stuff here with conn (socket)

you can also connect with an intercepted address (each service may
have one or more standard network address [protocol, host, port]):

conn = ztx.connect(('httpbin.ziti', 80))

Host(serve) Ziti service

import openziti

ztx = openziti.load(ziti_id)
server = ztx.bind(service)
server.listen()

while True:
    # conn is the incoming connection(socket)
    # peer is a tuple (connecting identity, 0)
    conn, peer = server.accept()

    # do some cool interaction with your client

It's 2022: WDIMMOS*?!!

*WDIMMOS: why do I manage my own sockets

Obviously when you develop your cool Python application you probably
would not start with writing your own networking layer. Instead,
you'd use excellent networking capabilities of Python standard
library or other modules to do networking for you. The good news is
that you can use OpenZiti SDK with other networking modules.

Client Side

For example, let's say you want to make an HTTP request with
requests, urllib3, or even urllib:

import requests

r = requests.get('http://httpbin.org/json')
print(r.headers)
print(r.json())

In order to make requests library use Ziti socket, we monkeypatch the
code. In this case you can request(get it?) with an intercepted
address.

import requests
import openziti

ztx = openziti.load('id.json')

with openziti.monkeypatch():
    # FIY, httpbin.ziti is a common service you can use in our sandbox
    r = requests.get('http://httpbin.ziti/json')
    print(r.headers)
    print(r.json())

Server Side

On the hosting server side we need inform the monkey patching code
what it needs to do when underlying networking code binds to an
address. This is done via bindings parameter to the monkeypatch()
method. The value must be a map from network address(host, port) to
the Ziti context/service -- like this:

import sys
from http.server import BaseHTTPRequestHandler, HTTPServer
import openziti

class MyServer(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header("Content-type", "application/json")
        self.end_headers()
        msg = """{"msg": "Hello! Have some ziti!"}"""
        self.wfile.write(bytes(msg, "utf-8"))

if __name__ == "__main__":
    bind_addr = ('localhost', 8080)
    srv_addr = {
        ztx: 'id.json',
        service: 'best-service-ever'
    }
    # map network bind address to Ziti Service target
    bind_map = { bind_addr: srv_addr }

    openziti.monkeypatch(bindings=bind_map)
    webServer = HTTPServer(bind_addr, MyServer)
    webServer.serve_forever(poll_interval=600)

Next Steps

We would love to hear from you about your applications and if decide
that OpenZiti is the right fit to secure them.

Checkout some of our projects that use OpenZiti Python SDK:

  * Call a Dark Webhook from AWS Lambda
  * Zitified Ansible/Paramiko

Follow us:

  * Python SDK repo
  * Main OpenZiti repo - give us a star!
  * Join discussion
  * Follow @openziti

[svg]Here's my likeHere's my like3
[svg]Claps clapsClaps claps1
 
 
 
Share this  

(c)2022 OpenZiti.io

Archive*Privacy policy*Terms
Publish with Hashnode

Powered by Hashnode - a blogging community for software developers.