Flask-GSSAPI 1.5.0

Installation

Install the easy way through PyPi:

$ pip install flask-gssapi

Or alternatively download and build yourself:

$ git clone https://github.com/cour4g3/flask-gssapi
$ cd flask-gssapi
$ python setup.py install

Usage

Usage is fairly simple:

from flask import Flask, render_template
from flask_gssapi import GSSAPI

app = Flask(__name__)

gssapi = GSSAPI(app)

# Here, you'll need to be authenticated
@app.route('/secret')
@gssapi.require_auth()
def secret_view():
    return render_template('secret.html')

# Here, you'll need to be a specific user
@app.route('/admin')
@gssapi.require_user('admin') # or old-style @gssapi.require_user(user='admin')
def admin_view():
    return render_template('admin.html')

# Or a list of users
@app.route('/staff')
@gssapi.require_user('admin', 'michael')
def staff_view():
    return render_template('staff.html')

# You can also get the username as a keyword argument
@app.route('/another-secret')
@gssapi.require_auth
def admin_view(username=''):
    return render_template('another-secret.html', username=username)

Configuration

For security purposes your application should probably not have read access to the system’s keytab, you should create a new keytab for the application:

$ export KRB5_KTNAME=FILE:/path/to/HTTP.keytab
$ net ads keytab create
$ net ads keytab add HTTP
$ chown httpd:httpd /path/to/HTTP.keytab

The KRB5_KTNAME will point to the correct keytab to use and can be included in your startup script or service file.

The defaults should be sufficient for most purposes, but you may need to be changed under certain circumstances:

Todo

• Offer fallback to a login page or Basic authentication if no credentials are provided i.e. non-domain connected device.

• Configuration key to protect all views by default with an equivalent no_auth decorator.

License

Licensed under the MIT License.