README.rst 4.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129
  1. PyKerberos Package
  2. ==================
  3. .. image:: https://travis-ci.org/apple/ccs-pykerberos.svg?branch=master
  4. :target: https://travis-ci.org/apple/ccs-pykerberos
  5. This Python package is a high-level wrapper for Kerberos (GSSAPI)
  6. operations. The goal is to avoid having to build a module that wraps
  7. the entire Kerberos.framework, and instead offer a limited set of
  8. functions that do what is needed for client/server Kerberos
  9. authentication based on <http://www.ietf.org/rfc/rfc4559.txt>.
  10. Much of the C-code here is adapted from Apache's mod_auth_kerb-5.0rc7.
  11. Build
  12. =====
  13. In this directory, run:
  14. python setup.py build
  15. Testing
  16. =======
  17. To run the tests in the tests folder, you must have a valid Kerberos setup on
  18. the test machine. You can use the script .travis.sh as quick and easy way to
  19. setup a Kerberos KDC and Apache web endpoint that can be used for the tests.
  20. Otherwise you can also run the following to run a self contained Docker
  21. container
  22. .. code-block: bash
  23. docker run \
  24. -v $(pwd):/app \
  25. -w /app \
  26. -e PYENV=2.7.13 \
  27. -e KERBEROS_USERNAME=administrator \
  28. -e KERBEROS_PASSWORD=Password01 \
  29. -e KERBEROS_REALM=example.com \
  30. -e KERBEROS_PORT=80 \
  31. ubuntu:16.04 \
  32. /bin/bash .travis.sh
  33. The docker command needs to be run in the same directory as this library and
  34. you can test it with different Python versions by changing the value of the
  35. PYENV environment value set in the command.
  36. Please have a look at testing_notes.md for more information.
  37. IMPORTANT
  38. =========
  39. The checkPassword method provided by this library is meant only for testing purposes as it does
  40. not offer any protection against possible KDC spoofing. That method should not be used in any
  41. production code.
  42. Channel Bindings
  43. ================
  44. You can use this library to authenticate with Channel Binding support. Channel
  45. Bindings are tags that identify the particular data channel being used with the
  46. authentication. You can use Channel bindings to offer more proof of a valid
  47. identity. Some services like Microsoft's Extended Protection can enforce
  48. Channel Binding support on authorisation and you can use this library to meet
  49. those requirements.
  50. More details on Channel Bindings as set through the GSSAPI can be found here
  51. <https://docs.oracle.com/cd/E19455-01/806-3814/overview-52/index.html>. Using
  52. TLS as a example this is how you would add Channel Binding support to your
  53. authentication mechanism. The following code snippet is based on RFC5929
  54. <https://tools.ietf.org/html/rfc5929> using the 'tls-server-endpoint-point'
  55. type.
  56. .. code-block:: python
  57. import hashlib
  58. def get_channel_bindings_application_data(socket):
  59. # This is a highly simplified example, there are other use cases
  60. # where you might need to use different hash types or get a socket
  61. # object somehow.
  62. server_certificate = socket.getpeercert(True)
  63. certificate_hash = hashlib.sha256(server_certificate).hexdigest().upper()
  64. certificate_digest = base64.b16decode(certificate_hash)
  65. application_data = b'tls-server-end-point:%s' % certificate_digest
  66. return application_data
  67. def main():
  68. # Code to setup a socket with the server
  69. # A lot of code to setup the handshake and start the auth process
  70. socket = getsocketsomehow()
  71. # Connect to the host and start the auth process
  72. # Build the channel bindings object
  73. application_data = get_channel_bindings_application_data(socket)
  74. channel_bindings = kerberos.channelBindings(application_data=application_data)
  75. # More work to get responses from the server
  76. result, context = kerberos.authGSSClientInit(kerb_spn, gssflags=gssflags, principal=principal)
  77. # Pass through the channel_bindings object as created in the kerberos.channelBindings method
  78. result = kerberos.authGSSClientStep(context, neg_resp_value, channel_bindings=channel_bindings)
  79. # Repeat as necessary
  80. Python APIs
  81. ===========
  82. See kerberos.py.
  83. Copyright and License
  84. =====================
  85. Copyright (c) 2006-2018 Apple Inc. All rights reserved.
  86. This software is licensed under the Apache License, Version 2.0. The
  87. Apache License is a well-established open source license, enabling
  88. collaborative open source software development.
  89. See the "LICENSE" file for the full text of the license terms.