lexmount-extra

Extra utilities for Lexmount Python SDK projects.

Install

pip install lexmount-extra

The package uses ntlm-auth for non-Windows NTLM credentials, pyspnego for Windows SSPI-backed Kerberos/NTLM, pyspnego[kerberos] for non-Windows Kerberos, and pycryptodome as an MD4 fallback for Python/OpenSSL builds that do not expose hashlib.new("md4").

On non-Windows Debian/Ubuntu images, installing the Kerberos dependency may also require the system package that provides krb5-config:

sudo apt-get install libkrb5-dev

Usage

from lexmount_extra import (
    createKerberosAuthCallback,
    createNTLMAuthCallback,
    generateKerberosToken,
    generateNTLMChallengeToken,
    generateNTLMResponseToken,
)

type1_token = generateNTLMChallengeToken("web.lab.local", "LAB")

type3_token = generateNTLMResponseToken(
    "http://web.lab.local/",
    "web.lab.local",
    "LAB",
    "NTLM <server-type2-token>",
    "alice",
    "P@ssw0rd123!",
)

kerberos_token = generateKerberosToken(
    "HTTP@web.lab.test",
    "server-token",
)

Pythonic snake_case aliases are available for every Node-compatible camelCase function.

Lexmount authentication callbacks

from lexmount import register_integrated_auth_callback
from lexmount_extra import createKerberosAuthCallback, createNTLMAuthCallback

ntlm_auth = createNTLMAuthCallback({
    "hostname": "web.lab.local",
    "domain": "LAB",
})

kerberos_auth = createKerberosAuthCallback({
    "hostname": "web.lab.test",
})

register_integrated_auth_callback(session, ntlm_auth)
register_integrated_auth_callback(session, kerberos_auth)

Both callback factories can be called without options. NTLM defaults to USERDNSDOMAIN and USERDOMAIN when those environment variables exist. Kerberos derives the HTTP@host service principal off Windows or HTTP/host on Windows from the authentication challenge origin when neither spn nor hostname is provided.

Kerberos integrated authentication

Windows Kerberos generation uses SSPI through pyspnego, avoiding the non-Windows gssapi dependency. Non-Windows platforms continue to use gssapi through pyspnego[kerberos].

NTLM integrated authentication

Windows NTLM generation uses SSPI through pyspnego. Type 1 and Type 3 tokens both support explicit username/password credentials, and Type 3 can also use the current Windows logon session when credentials are omitted. The Lexmount callback keeps the SSPI context between Type 1 and Type 3 by using the request's frameId and requestId.

Non-Windows platforms use ntlm-auth. They support Type 1 and Type 3 with explicit username/password credentials; Type 3 without credentials returns an empty token.