PKG-INFO 6.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148
  1. Metadata-Version: 1.1
  2. Name: kerberos
  3. Version: 1.3.0
  4. Summary: Kerberos high-level interface
  5. Home-page: https://github.com/apple/ccs-pykerberos
  6. Author: Apple Inc.
  7. Author-email: calendarserver-dev@lists.macosforge.org
  8. License: Apache License, Version 2.0
  9. Description-Content-Type: UNKNOWN
  10. Description: PyKerberos Package
  11. ==================
  12. .. image:: https://travis-ci.org/apple/ccs-pykerberos.svg?branch=master
  13. :target: https://travis-ci.org/apple/ccs-pykerberos
  14. This Python package is a high-level wrapper for Kerberos (GSSAPI)
  15. operations. The goal is to avoid having to build a module that wraps
  16. the entire Kerberos.framework, and instead offer a limited set of
  17. functions that do what is needed for client/server Kerberos
  18. authentication based on <http://www.ietf.org/rfc/rfc4559.txt>.
  19. Much of the C-code here is adapted from Apache's mod_auth_kerb-5.0rc7.
  20. Build
  21. =====
  22. In this directory, run:
  23. python setup.py build
  24. Testing
  25. =======
  26. To run the tests in the tests folder, you must have a valid Kerberos setup on
  27. the test machine. You can use the script .travis.sh as quick and easy way to
  28. setup a Kerberos KDC and Apache web endpoint that can be used for the tests.
  29. Otherwise you can also run the following to run a self contained Docker
  30. container
  31. .. code-block: bash
  32. docker run \
  33. -v $(pwd):/app \
  34. -w /app \
  35. -e PYENV=2.7.13 \
  36. -e KERBEROS_USERNAME=administrator \
  37. -e KERBEROS_PASSWORD=Password01 \
  38. -e KERBEROS_REALM=example.com \
  39. -e KERBEROS_PORT=80 \
  40. ubuntu:16.04 \
  41. /bin/bash .travis.sh
  42. The docker command needs to be run in the same directory as this library and
  43. you can test it with different Python versions by changing the value of the
  44. PYENV environment value set in the command.
  45. Please have a look at testing_notes.md for more information.
  46. IMPORTANT
  47. =========
  48. The checkPassword method provided by this library is meant only for testing purposes as it does
  49. not offer any protection against possible KDC spoofing. That method should not be used in any
  50. production code.
  51. Channel Bindings
  52. ================
  53. You can use this library to authenticate with Channel Binding support. Channel
  54. Bindings are tags that identify the particular data channel being used with the
  55. authentication. You can use Channel bindings to offer more proof of a valid
  56. identity. Some services like Microsoft's Extended Protection can enforce
  57. Channel Binding support on authorisation and you can use this library to meet
  58. those requirements.
  59. More details on Channel Bindings as set through the GSSAPI can be found here
  60. <https://docs.oracle.com/cd/E19455-01/806-3814/overview-52/index.html>. Using
  61. TLS as a example this is how you would add Channel Binding support to your
  62. authentication mechanism. The following code snippet is based on RFC5929
  63. <https://tools.ietf.org/html/rfc5929> using the 'tls-server-endpoint-point'
  64. type.
  65. .. code-block:: python
  66. import hashlib
  67. def get_channel_bindings_application_data(socket):
  68. # This is a highly simplified example, there are other use cases
  69. # where you might need to use different hash types or get a socket
  70. # object somehow.
  71. server_certificate = socket.getpeercert(True)
  72. certificate_hash = hashlib.sha256(server_certificate).hexdigest().upper()
  73. certificate_digest = base64.b16decode(certificate_hash)
  74. application_data = b'tls-server-end-point:%s' % certificate_digest
  75. return application_data
  76. def main():
  77. # Code to setup a socket with the server
  78. # A lot of code to setup the handshake and start the auth process
  79. socket = getsocketsomehow()
  80. # Connect to the host and start the auth process
  81. # Build the channel bindings object
  82. application_data = get_channel_bindings_application_data(socket)
  83. channel_bindings = kerberos.channelBindings(application_data=application_data)
  84. # More work to get responses from the server
  85. result, context = kerberos.authGSSClientInit(kerb_spn, gssflags=gssflags, principal=principal)
  86. # Pass through the channel_bindings object as created in the kerberos.channelBindings method
  87. result = kerberos.authGSSClientStep(context, neg_resp_value, channel_bindings=channel_bindings)
  88. # Repeat as necessary
  89. Python APIs
  90. ===========
  91. See kerberos.py.
  92. Copyright and License
  93. =====================
  94. Copyright (c) 2006-2018 Apple Inc. All rights reserved.
  95. This software is licensed under the Apache License, Version 2.0. The
  96. Apache License is a well-established open source license, enabling
  97. collaborative open source software development.
  98. See the "LICENSE" file for the full text of the license terms.
  99. Platform: all
  100. Classifier: Development Status :: 5 - Production/Stable
  101. Classifier: Intended Audience :: Developers
  102. Classifier: License :: OSI Approved :: Apache Software License
  103. Classifier: Operating System :: OS Independent
  104. Classifier: Programming Language :: Python :: 2
  105. Classifier: Programming Language :: Python :: 3
  106. Classifier: Topic :: Software Development :: Libraries :: Python Modules
  107. Classifier: Topic :: System :: Systems Administration :: Authentication/Directory