requests/requests-kerberos — pull request #12 by mkomitee (2013-04-05 20:19:16+00:00)
Title: Handle additional GSSErrors

I finally experienced an actual mutual authentication failure in the wild and the library didn't perform as expected. Instead of raising a ``MutualAuthenticationError`` as I expected, I received the bare ``GSSError``.

Apparently, ``kerberos.authGSSClientStep()`` can raise a ``GSSError`` on a mutual authentication failure instead of just setting the returncode to ``-1`` as would be expected from the underlying C library calls. Catch that ``GSSError`` and return ``False`` so that we handle the mutual authentication failure appropriately.

Since every other kerberos call can raise a ``GSSError``, prophylactically wrap ``kerberos.authGSSClientResponse()`` in such a way as to prevent other ``GSSErrors`` from reaching the user. In this case we'll return the ``401`` to the user just as we do when authentication fails in other ways.