Kerberos authentication w/ Python on Windows

[Brian Beck]

After a bit of searching I haven't been able to find a definite resource
for Kerberos authentication from Python. Any help would be appreciated.
Here's what I've found...

[1] http://starship.python.net/crew/fdrake/manuals/krb5py/krb5py.html
This looks all well and good, but the 'original software package'
referenced here doesn't work, and as far as I can tell, doesn't even
seem to exist (and I do have Handler).

[2] The best I could find in Zope appears to just get its result from
the UNIX/Linux krb5 command, which does all the heavy lifting. This is
not available on Windows.

[3] http://pygss.sourceforge.net/
I can't really tell if this is what I'm looking for. It does
provide a way to interface with MIT's krb5, but it must be obtained
separately and compiled...

Thanks in advance for any help!

 

[Donn Cave]

After a bit of searching I haven't been able to find a definite resource
for Kerberos authentication from Python. Any help would be appreciated.

The only thing I know out there -

ftp://www.python.org/pub/www.python.org/ftp/python/contrib-09-Dec-1999/Sy
stem/krb5module-0.1.tar.gz

Written by Fred Drake and Roger Masse for CNRI, it's not very
recent but that's probably the least of your problems. It does
have some preprocessor conditionals as though they were building
it on Windows at some point.

Here's what I've found... ....
[2] The best I could find in Zope appears to just get its result from
the UNIX/Linux krb5 command, which does all the heavy lifting. This is
not available on Windows.

That krb5 command does not sound like anything I have ever seen.
It isn't "available" on UNIX either, it's just something that
you have to get and probably build (I guess - I've never heard of
external Kerberos authentication, sounds like a bad idea to me.)

[3] http://pygss.sourceforge.net/
I can't really tell if this is what I'm looking for. It does
provide a way to interface with MIT's krb5, but it must be obtained
separately and compiled...

Well, naturally. I don't know this software, but by the name
evidently it's a GSSAPI interface. Conventional wisdom has it
that applications should use GSSAPI for Kerberos 5 authentication.
It actually doesn't have complete, end-to-end coverage for the
problem area, so commonly you end up needing to call the
underlying krb5 library anyway for some miscellaneous functions,
and honestly it's a verbose, awkward mess to program to, but
you get a more reliable application out of it if you're doing
things like data encryption on top of the minimal authentication
function. And I understand that at some level it may be compatible
with a protocol that Microsoft Windows' native Kerberos 5
implementation uses.

I don't know much about any special issues that you might be
facing on Microsoft Windows, but all this is fairly simple
on UNIX and I know MS made Kerberos5 integral to Windows
authentication, so what could go wrong?

Donn Cave, (e-mail address removed)