Skip to main content

Cern Single-Single-Sign-On driver

Project description

This is a re-implementation of the Perl script
as a Python library. As a bonus, a shell client re-implementing (most
of) the functionality of ``cern-get-sso-cookie``, is also provided.

.. _cern-get-sso-cookie:


This package assumes a working Kerberos and OpenSSL setup, but should be
compatible with both python 2.7 and 3.


The module provides only two functions: ``krb_sign_on`` and
``cert_sign_on``, used for authentication with Kerberos and certificates
respectively. Both take an optional cookiejar (which can be a Requests
``CookieJar``, or a ``MozillaCookieJar``) which is filled during
operations. In any event, a cookie jar is also returned by both

The returned cookie jar can be used directly as an argument to Requests'

.. code:: python

import cern_sso
import requests

my_url = ""

cookies = cern_sso.krb_sign_on(my_url)

# Perform request
r1 = requests.get(my_url, cookies=cookies)

It is assumed that the user running the program is already authenticated
against Kerberos.

This is what the same procedure would look like using SSL certificates:

.. code:: python

import cern_sso
import requests

my_url = ""
cert_file = "/home/albin/myCert.pem"
key_file = "/home/albin/myCert.key"

cookies = cern_sso.cert_sign_on(my_url, cert_file=cert_file,

# Perform request
r1 = requests.get(my_url, cookies=cookies)

Certain limitations apply to the certificate and key files, please see
the following section on command-line usage for further information on

For an example of how to use an external CookieJar, see

Using ````

Just like ``cern-get-sso-cookie``, the Python implementation will
authenticate against a desired URL and returna Mozilla cookie-file
suitable for use with Curl or Wget.

For use with Kerberos, make sure you are authenticated either via
password or a keytab:

.. code:: sh
$ kinit me@CERN.CH
<enter password>

Now you can perform the authentication:

.. code:: sh
$ --url --kerberos
# cookies.txt now contains the relevant session cookies
$ curl -L --cookie cookies.txt --cookie-jar cookies.txt -H 'Accept: application/json' ""

In the spirit of the UNIX philosophy, ```` outputs
nothing on success. Please try ``--verbose`` or even ``--debug`` if that is
not to your liking!

For authentication against a SSL certificate (and key), you first need
to process the certificate files to remove passwords and separate the
key and certificate:

.. code:: sh
$ openssl pkcs12 -clcerts -nokeys -in myCert.p12 -out myCert.pem

$ openssl pkcs12 -nocerts -in myCert.p12 -out myCert.tmp.key

$ openssl rsa -in myCert.tmp.key -out myCert.key

It is assumed that your certificate and key files have the same base
name and are located in the same folder, and that the key has the file
ending ``.key`` and the certificate ``.pem``. In the example above, the base
name ``myCert`` was used.

Finally, you can use the certificates to obtain a SSO cookie:

.. code:: sh
$ --url --cert myCert

For further notes on usage, see `` --help``.

Project details

Release history Release notifications

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Filename, size & hash SHA256 hash help File type Python version Upload date
python-cern-sso-krb-1.3.3.tar.gz (6.8 kB) Copy SHA256 hash SHA256 Source None

Supported by

Elastic Elastic Search Pingdom Pingdom Monitoring Google Google BigQuery Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN SignalFx SignalFx Supporter DigiCert DigiCert EV certificate StatusPage StatusPage Status page