Skip to main content

Python GSSAPI Wrapper

Project description

Python-GSSAPI provides both low-level and high level wrappers around the GSSAPI C libraries. While it focuses on the Kerberos mechanism, it should also be useable with other GSSAPI mechanisms.

Documentation for the latest released version (including pre-release versions) can be found at

Documentation for the latest commit on main can be found at



  • A working implementation of GSSAPI (such as from MIT Kerberos) which supports delegation and includes header files
  • a C compiler (such as GCC)
  • Python 3.6+ (older releases support older versions, but are unsupported)
  • the decorator python package

Compiling from Scratch

To compile from scratch, you will need Cython >= 0.21.1.

For Running the Tests

  • the nose package
  • the k5test package

To install test dependencies using pip:

$ pip install -r test-requirements.txt # Optional, for running test suite


Easy Way

$ pip install gssapi

From the Git Repo

After being sure to install all the requirements,

$ git clone
$ python build
$ python install


The tests for for Python-GSSAPI live in gssapi.tests. In order to run the tests, you must have an MIT Kerberos installation (including the KDC). The tests create a self-contained Kerberos setup, so running the tests will not interfere with any existing Kerberos installations.


Python-GSSAPI is composed of two parts: a low-level C-style API which thinly wraps the underlying RFC 2744 methods, and a high-level, Pythonic API (which is itself a wrapper around the low-level API). Examples may be found in the examples directory.

Low-Level API

The low-level API lives in gssapi.raw. The methods contained therein are designed to match closely with the original GSSAPI C methods. All relevant methods and classes may be imported directly from gssapi.raw. Extension methods will only be imported if they are present. The low-level API follows the given format:

  • Names match the RFC 2744 specification, with the gssapi_ prefix removed
  • Parameters which use C int constants as enums have enum.IntEnum classes defined, and thus may be passed either the enum members or integers
  • In cases where a specific constant is passed in the C API to represent a default value, None should be passed instead
  • In cases where non-integer constants would be used in the API (i.e. OIDs), enum-like objects have been defined containing named references to values specified in RFC 2744.
  • Major and minor error codes are returned by raising gssapi.raw.GSSError. The major error codes have exceptions defined in in gssapi.raw.exceptions to make it easier to catch specific errors or categories of errors.
  • All other relevant output values are returned via named tuples.

High-Level API

The high-level API lives directly under gssapi. The classes contained in each file are designed to provide a more Pythonic, Object-Oriented view of GSSAPI. The exceptions from the low-level API, plus several additional exceptions, live in gssapi.exceptions. The rest of the classes may be imported directly from gssapi. Only classes are exported by gssapi – all functions are methods of classes in the high-level API.

Please note that QoP is not supported in the high-level API, since it has been deprecated.


In addition to RFC 2743/2744, Python-GSSAPI also has support for:

  • RFC 5587 (Extended GSS Mechanism Inquiry APIs)
  • RFC 5588 (GSS-API Extension for Storing Delegated Credentials)
  • (Additional) Credential Store Extension
  • Services4User
  • Credentials import-export
  • RFC 6680 (GSS-API Naming Extensions)
  • DCE and IOV MIC extensions
  • acquire_cred_with_password and add_cred_with_password
  • GGF Extensions

The Team

(GitHub usernames in parentheses)

  • Robbie Harwood (@frozencemetery) - current maintainer and developer
  • Simo Sorce (@simo5) - developer
  • Solly Ross (@directxman12) - author emeritus
  • Hugh Cole-Baker (@sigmaris) - author emeritus

Get Involved

We welcome new contributions in the form of Issues and Pull Requests on Github. If you would like to join our discussions, you can find us on Freenode IRC, channel #python-gssapi.

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for gssapi, version 1.6.12
Filename, size File type Python version Upload date Hashes
Filename, size gssapi-1.6.12-cp36-cp36m-win_amd64.whl (658.0 kB) File type Wheel Python version cp36 Upload date Hashes View
Filename, size gssapi-1.6.12-cp37-cp37m-win_amd64.whl (659.1 kB) File type Wheel Python version cp37 Upload date Hashes View
Filename, size gssapi-1.6.12-cp38-cp38-win_amd64.whl (672.3 kB) File type Wheel Python version cp38 Upload date Hashes View
Filename, size gssapi-1.6.12-cp39-cp39-win_amd64.whl (670.6 kB) File type Wheel Python version cp39 Upload date Hashes View
Filename, size gssapi-1.6.12.tar.gz (1.1 MB) File type Source Python version None Upload date Hashes View

Supported by

Pingdom Pingdom Monitoring Google Google Object Storage and Download Analytics Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page