Repository files navigation

Python-GSSAPI provides both low-level and high level wrappers around the GSSAPIC libraries. While it focuses on the Kerberos mechanism, it should also beuseable with other GSSAPI mechanisms.

Documentation can be found athttps://pythongssapi.github.io/python-gssapi/.

• A working implementation of GSSAPI (such as from MIT Kerberos)which supports delegation and includes header files
• a C compiler (such as GCC)
• Python 3.8+ (older releases support older versions, but are unsupported)
• the decorator python package

To compile from scratch, you will need Cython>= 3.0.3, < 4.0.0 which is automaticallyinstalled by pip in an isolated build virtual environment.

• the k5test package

To install test dependencies using pip:

$ pip install -r test-requirements.txt# Optional, for running test suite

$ pip install gssapi

After being sure to install all the requirements,

$ git clone https://github.com/pythongssapi/python-gssapi.git$ pip install.

The tests for for Python-GSSAPI live in gssapi.tests. In order torun the tests, you must have an MIT Kerberos installation (includingthe KDC). The tests create a self-contained Kerberos setup, so runningthe tests will not interfere with any existing Kerberos installations.

Python-GSSAPI is composed of two parts: a low-level C-style API whichthinly wraps the underlying RFC 2744 methods, and a high-level, PythonicAPI (which is itself a wrapper around the low-level API). Examples maybe found in the examples directory.

The low-level API lives in gssapi.raw. The methods contained thereinare designed to match closely with the original GSSAPI C methods. Allrelevant methods and classes may be imported directly from gssapi.raw.Extension methods will only be imported if they are present. The low-levelAPI follows the given format:

• Names match the RFC 2744 specification, with thegssapi_prefix removed
• Parameters which use C int constants as enums haveenum.IntEnum classes defined, and thus may be passedeither the enum members or integers
• In cases where a specific constant is passed in the C API to representa default value,None should be passed instead
• In cases where non-integer constants would be used in the API (i.e.OIDs), enum-like objects have been defined containing named referencesto values specified in RFC 2744.
• Major and minor error codes are returned by raisinggssapi.raw.GSSError. The major error codes have exceptionsdefined in in gssapi.raw.exceptions to make it easier to catch specificerrors or categories of errors.
• All other relevant output values are returned via named tuples.

The high-level API lives directly undergssapi. The classescontained in each file are designed to provide a more Pythonic, Object-Orientedview of GSSAPI. The exceptions from the low-level API, plus several additionalexceptions, live in gssapi.exceptions. The rest of the classes may beimported directly from gssapi. Only classes are exported by gssapi --all functions are methods of classes in the high-level API.

Please note that QoP is not supported in the high-level API, since it has beendeprecated.

In addition to RFC 2743/2744, Python-GSSAPI also has support for:

• RFC 4178 (GSS-API Negotiation Mechanism)
• RFC 5587 (Extended GSS Mechanism Inquiry APIs)
• RFC 5588 (GSS-API Extension for Storing Delegated Credentials)
• RFC 5801 (GSS-API SASL Extensions)
• (Additional) Credential Store Extension
• Services4User
• Credentials import-export
• RFC 6680 (GSS-API Naming Extensions)
• DCE and IOV MIC extensions
• acquire_cred_with_password and add_cred_with_password
• GGF Extensions
• Kerberos specific extensions

(GitHub usernames in parentheses)

• Jordan Borean (@jborean93) - current maintainer and developer
• Simo Sorce (@simo5) - developer
• Robbie Harwood (@frozencemetery) - author emeritus
• Solly Ross (@directxman12) - author emeritus
• Hugh Cole-Baker (@sigmaris) - author emeritus

We welcome new contributions in the form of Issues and Pull Requests onGithub. If you would like to join our discussions, you can find us onlibera.chat IRC, channel #python-gssapi.