Kerberos authentication backend for Python Social Auth
This package provides Kerberos backend for Python Social Auth. It can be used to enable passwordless authentication inside a Django app or any other application that supports Python Social Auth. This is a pure Python implementation which doesn’t depend on Apache mod_auth_kerb.
Installation
To install:
pip install social-auth-kerberos
Configuration
Configure Python Social Auth and then make sure you have the following settings enabled:
AUTHENTICATION_BACKENDS = [
'social_auth_kerberos.backend.KerberosAuth',
'django.contrib.auth.backends.ModelBackend',
]
SOCIAL_AUTH_KRB5_KEYTAB = '/Kiwi/your-application.keytab'
IMPORTANT:
The principal name for your Kiwi TCMS web service must be HTTP/<fqdn.example.com>@REALM.EXAMPLE.COM where fqdn.example.com is the domain name of the Kiwi TCMS server and REALM.EXAMPLE.COM is the Kerberos realm that is used in your organization.
/Kiwi/your-application.keytab is the keytab file for your web app principal! If you install this inside a Docker container make sure to chown 1001:root!
Pipeline configuration
Python Social Auth, and by extension this plugin, will create new user accounts upon first access of the web interface. In Kiwi TCMS users need to either be in the special group Tester or have sufficient permissions to add/edit/delete objects.
You can automatically assign new accounts to the Tester group if you append social_auth_kerberos.pipeline.initiate_defaults to the end of the SOCIAL_AUTH_PIPELINE setting.
WARNING: this is not done for you automatically because some administrators may want to employ different behaviour for newly registered accounts!
Kerberos configuration
For more information about Kerberos see:
or check out tests/Dockerfile.kerberos.
Changelog
v0.2.4 (24 Mar 2020)
Add social_auth_kerberos.pipeline with function to initialize default permissions for newly created accounts. See section Pipeline configuration
Update README with more information how to configure this plugin
Enable integration testing with Kerberos and coverage collection
v0.2.3 (22 Mar 2020)
Keep a reference to current user before checking anything else. Resolves a crash for clients which know that the server is Kerberos enabled and directly send the Authorization header
Be more tolerant to authorization request headers which don’t match RFC-4459, section 4.2
v0.2.2 (10 Nov 2019)
Pin license version to GPLv2 for Tidelift
v0.2.1 (10 Dec 2018)
Initial release
1 maintainer
Metadata
1 maintainer
Release files for social-auth-kerberos 0.2.4
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| social-auth-kerberos-0.2.4.tar.gz | 4.6 kB | Without provenance | Details for social-auth-kerberos-0.2.4.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| social_auth_kerberos-0.2.4-py3-none-any.whl | Python 3 | none | any | Details for social_auth_kerberos-0.2.4-py3-none-any.whl |
Total release size: 12.5 kB
Security for social-auth-kerberos 0.2.4
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
Release files / social-auth-kerberos-0.2.4.tar.gz
How to use checksums
223714a076f0ef2861826842f09498ee17516bb1b528afc0321861433398bcf5How to use checksums
0eddb437f48cbc1fcf62091559d25c080e49f958267ee534c32a211cf0966dc3What is trusted publishing?
twine/3.1.1 pkginfo/1.5.0.1 requests/2.22.0 setuptools/45.1.0 requests-toolbelt/0.9.1 tqdm/4.41.1 CPython/3.6.9