Package: winkerberos
Info:Seegithubfor the latest source.Author:Bernie Hackett <bernie@mongodb.com>AboutA native Kerberos client implementation for Python on Windows. This module
mimics the API ofpykerberosto
implement Kerberos authentication with Microsoft’s Security Support Provider
Interface (SSPI). It supports Python 3.7+.InstallationWinKerberos is in thePython Package Index (pypi). Usepipto install it:python -m pip install winkerberosWinKerberos requires Windows 7 / Windows Server 2008 R2 or newer.Building and installing from sourceYou must have the correct version of VC++ installed for your version of
Python:Python 3.7+ - Visual Studio 2015+ (Any version)Once you have the required compiler installed, run the following command from
the root directory of the WinKerberos source:pip install .Building HTML documentationFirst installSphinx:python -m pip install SphinxThen run the following command from the root directory of the WinKerberos
source:pip install -e .
python -m sphinx -b html doc doc/_buildExamplesThis is a simplified example of a complete authentication session
following RFC-4752, section 3.1:importwinkerberosaskerberosdefsend_response_and_receive_challenge(response):# Your server communication code here...passdefauthenticate_kerberos(service,user,channel_bindings=None):# Initialize the context object with a service principal.status,ctx=kerberos.authGSSClientInit(service)# GSSAPI is a "client goes first" SASL mechanism. Send the# first "response" to the server and recieve its first# challenge.ifchannel_bindingsisnotNone:status=kerberos.authGSSClientStep(ctx,"",channel_bindings=channel_bindings)else:status=kerberos.authGSSClientStep(ctx,"")response=kerberos.authGSSClientResponse(ctx)challenge=send_response_and_receive_challenge(response)# Keep processing challenges and sending responses until# authGSSClientStep reports AUTH_GSS_COMPLETE.whilestatus==kerberos.AUTH_GSS_CONTINUE:ifchannel_bindingsisnotNone:status=kerberos.authGSSClientStep(ctx,challenge,channel_bindings=channel_bindings)else:status=kerberos.authGSSClientStep(ctx,challenge)response=kerberos.authGSSClientResponse(ctx)or''challenge=send_response_and_receive_challenge(response)# Decrypt the server's last challengekerberos.authGSSClientUnwrap(ctx,challenge)data=kerberos.authGSSClientResponse(ctx)# Encrypt a response including the user principal to authorize.kerberos.authGSSClientWrap(ctx,data,user)response=kerberos.authGSSClientResponse(ctx)# Complete authentication.send_response_and_receive_challenge(response)Channel bindings can be generated with help from thecryptographymodule. Seehttps://tools.ietf.org/html/rfc5929#section-4.1for the rules regarding
hash algorithm choice:fromcryptographyimportx509fromcryptography.hazmat.backendsimportdefault_backendfromcryptography.hazmat.primitivesimporthashesdefchannel_bindings(ssl_socket):server_certificate=ssl_socket.getpeercert(True)cert=x509.load_der_x509_certificate(server_certificate,default_backend())hash_algorithm=cert.signature_hash_algorithmifhash_algorithm.namein('md5','sha1'):digest=hashes.Hash(hashes.SHA256(),default_backend())else:digest=hashes.Hash(hash_algorithm,default_backend())digest.update(server_certificate)application_data=b"tls-server-end-point:"+digest.finalize()returnkerberos.channelBindings(application_data=application_data)Viewing API Documentation without SphinxUse the help function in the python interactive shell:>>>importwinkerberos>>>help(winkerberos)