Skip to main content

Kerberos authentication backend for Python Social Auth

Project description

https://github.com/kiwitcms/python-social-auth-kerberos/workflows/integration%20test/badge.svg https://coveralls.io/repos/github/kiwitcms/python-social-auth-kerberos/badge.svg?branch=master Tidelift Become a sponsor Kiwi TCMS on Twitter

This package provides Kerberos backend for Python Social Auth. It can be used to enable passwordless authentication inside a Django app or any other application that supports Python Social Auth. This is a pure Python implementation which doesn’t depend on Apache mod_auth_kerb.

Installation

To install:

pip install social-auth-kerberos

Configuration

Configure Python Social Auth and then make sure you have the following settings enabled:

AUTHENTICATION_BACKENDS = [
    'social_auth_kerberos.backend.KerberosAuth',
    'django.contrib.auth.backends.ModelBackend',
]

SOCIAL_AUTH_KRB5_KEYTAB = '/Kiwi/your-application.keytab'

IMPORTANT:

The principal name for your Kiwi TCMS web service must be HTTP/<fqdn.example.com>@REALM.EXAMPLE.COM where fqdn.example.com is the domain name of the Kiwi TCMS server and REALM.EXAMPLE.COM is the Kerberos realm that is used in your organization.

/Kiwi/your-application.keytab is the keytab file for your web app principal! If you install this inside a Docker container make sure to chown 1001:root!

Pipeline configuration

Python Social Auth, and by extension this plugin, will create new user accounts upon first access of the web interface. In Kiwi TCMS users need to either be in the special group Tester or have sufficient permissions to add/edit/delete objects.

You can automatically assign new accounts to the Tester group if you append social_auth_kerberos.pipeline.initiate_defaults to the end of the SOCIAL_AUTH_PIPELINE setting.

WARNING: this is not done for you automatically because some administrators may want to employ different behaviour for newly registered accounts!

Kerberos configuration

For more information about Kerberos see:

or check out tests/Dockerfile.kerberos.

Changelog

v0.2.4 (24 Mar 2020)

  • Add social_auth_kerberos.pipeline with function to initialize default permissions for newly created accounts. See section Pipeline configuration
  • Update README with more information how to configure this plugin
  • Enable integration testing with Kerberos and coverage collection

v0.2.3 (22 Mar 2020)

  • Keep a reference to current user before checking anything else. Resolves a crash for clients which know that the server is Kerberos enabled and directly send the Authorization header
  • Be more tolerant to authorization request headers which don’t match RFC-4459, section 4.2

v0.2.2 (10 Nov 2019)

  • Pin license version to GPLv2 for Tidelift

v0.2.1 (10 Dec 2018)

  • Initial release

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for social-auth-kerberos, version 0.2.4
Filename, size File type Python version Upload date Hashes
Filename, size social_auth_kerberos-0.2.4-py3-none-any.whl (7.9 kB) File type Wheel Python version py3 Upload date Hashes View
Filename, size social-auth-kerberos-0.2.4.tar.gz (4.6 kB) File type Source Python version None Upload date Hashes View

Supported by

Pingdom Pingdom Monitoring Google Google Object Storage and Download Analytics Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page