Skip to main content

High level interface to SSPI for Kerberos client auth

Project description

Info:See github for the latest source.
Author: Bernie Hackett <>


A native Kerberos client implementation for Python on Windows. This module mimics the API of pykerberos to implement Kerberos authentication with Microsoft’s Security Support Provider Interface (SSPI). It supports Python 2.7 and 3.5+.


WinKerberos is in the Python Package Index (pypi). Use pip to install it:

python -m pip install winkerberos

WinKerberos requires Windows 7 / Windows Server 2008 R2 or newer.

Building and installing from source

You must have the correct version of VC++ installed for your version of Python:

Once you have the required compiler installed, run the following command from the root directory of the WinKerberos source:

python install

Building HTML documentation

First install Sphinx:

python -m pip install Sphinx

Then run the following command from the root directory of the WinKerberos source:

python doc


This is a simplified example of a complete authentication session following RFC-4752, section 3.1:

import winkerberos as kerberos

def send_response_and_receive_challenge(response):
    # Your server communication code here...

def authenticate_kerberos(service, user, channel_bindings=None):
    # Initialize the context object with a service principal.
    status, ctx = kerberos.authGSSClientInit(service)

    # GSSAPI is a "client goes first" SASL mechanism. Send the
    # first "response" to the server and recieve its first
    # challenge.
    if channel_bindings is not None:
        status = kerberos.authGSSClientStep(
            ctx, "", channel_bindings=channel_bindings)
        status = kerberos.authGSSClientStep(ctx, "")
    response = kerberos.authGSSClientResponse(ctx)
    challenge = send_response_and_receive_challenge(response)

    # Keep processing challenges and sending responses until
    # authGSSClientStep reports AUTH_GSS_COMPLETE.
    while status == kerberos.AUTH_GSS_CONTINUE:
        if channel_bindings is not None:
            status = kerberos.authGSSClientStep(
                ctx, challenge, channel_bindings=channel_bindings)
            status = kerberos.authGSSClientStep(ctx, challenge)

        response = kerberos.authGSSClientResponse(ctx) or ''
        challenge = send_response_and_receive_challenge(response)

    # Decrypt the server's last challenge
    kerberos.authGSSClientUnwrap(ctx, challenge)
    data = kerberos.authGSSClientResponse(ctx)
    # Encrypt a response including the user principal to authorize.
    kerberos.authGSSClientWrap(ctx, data, user)
    response = kerberos.authGSSClientResponse(ctx)

    # Complete authentication.

Channel bindings can be generated with help from the cryptography module. See for the rules regarding hash algorithm choice:

from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes

def channel_bindings(ssl_socket):
    server_certificate = ssl_socket.getpeercert(True)
    cert = x509.load_der_x509_certificate(server_certificate, default_backend())
    hash_algorithm = cert.signature_hash_algorithm
    if in ('md5', 'sha1'):
        digest = hashes.Hash(hashes.SHA256(), default_backend())
        digest = hashes.Hash(hash_algorithm, default_backend())
    application_data = b"tls-server-end-point:" + digest.finalize()
    return kerberos.channelBindings(application_data=application_data)

Viewing API Documentation without Sphinx

Use the help function in the python interactive shell:

>>> import winkerberos
>>> help(winkerberos)

Project details

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution (44.0 kB view hashes)

Uploaded source

Built Distributions

winkerberos-0.9.0-cp310-cp310-win_amd64.whl (23.8 kB view hashes)

Uploaded cp310

winkerberos-0.9.0-cp310-cp310-win32.whl (21.3 kB view hashes)

Uploaded cp310

winkerberos-0.9.0-cp39-cp39-win_amd64.whl (23.8 kB view hashes)

Uploaded cp39

winkerberos-0.9.0-cp39-cp39-win32.whl (21.3 kB view hashes)

Uploaded cp39

winkerberos-0.9.0-cp38-cp38-win_amd64.whl (23.8 kB view hashes)

Uploaded cp38

winkerberos-0.9.0-cp38-cp38-win32.whl (21.3 kB view hashes)

Uploaded cp38

winkerberos-0.9.0-cp37-cp37m-win_amd64.whl (23.7 kB view hashes)

Uploaded cp37

winkerberos-0.9.0-cp37-cp37m-win32.whl (21.2 kB view hashes)

Uploaded cp37

winkerberos-0.9.0-cp36-cp36m-win_amd64.whl (25.2 kB view hashes)

Uploaded cp36

winkerberos-0.9.0-cp36-cp36m-win32.whl (22.0 kB view hashes)

Uploaded cp36

winkerberos-0.9.0-cp35-cp35m-win_amd64.whl (25.1 kB view hashes)

Uploaded cp35

winkerberos-0.9.0-cp35-cp35m-win32.whl (22.0 kB view hashes)

Uploaded cp35

winkerberos-0.9.0-cp27-cp27m-win_amd64.whl (22.6 kB view hashes)

Uploaded cp27

winkerberos-0.9.0-cp27-cp27m-win32.whl (20.1 kB view hashes)

Uploaded cp27

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Huawei Huawei PSF Sponsor Microsoft Microsoft PSF Sponsor NVIDIA NVIDIA PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page