How to set up a connection with Kerberos in Python application?

Question

I have task to create SSO (single sign-on) authorization in Python backend application with the help of Kerberos and Active Directory.

In other words, frontend application make AJAX GET request of the specific URL of the backend application. That backend application must return information about employee in JSON format.

What I have done so far:

1) SPN name for the backend application was created in Active Directory.

2) krb5.keytab file for the backend application was created.

3) Active Directory and Kerberos server located on remote Windows server.

4) Backend application would be in Linux Docker container.

5) I install Kerberos client to Docker container.

6) Kerberos Realm: SERVICE.LOCAL.

7) Hostname for the KDC Server: CS001, CS002, CS003.

Have you ever seen any implementations of the above process in Python? I will be grateful for any help.

Answer 1

You have 2 ways to handle this:

1. Handle it directly in Python
2. Handle it in a proxy such as apache or nginx

Pure Python Solution

If you don't have a proxy or just want to handle it in python anyway, I recommend using the python-gssapi library. Here's a code sample. There are other Python bindings but from my reading, this one seems to be the most complete.

Note, if you handle it this way, your python server will probably need to be able to respect the keep-alive header (i.e. re-use the same connection for multiple requests). This isn't strictly part of the SPENGO protocol, but most browsers seem to require that the server implements it.

Proxy Solution

If you're using apache, there's a mod_auth_kerb module you can use which is well documented. There's also a mod_auth_gssapi which provides similar functionality.

For nginx, there's a similar module available.

With any of these proxy solutions, the idea is that the proxy handles Kerberos auth, and sets the REMOTE_USER env variable for your python app. So your python app needs to be able to accept this variable as an authenticated user. Django has middleware specifically for that purpose - I'm not sure about Flask (I mention these 2 frameworks because they're in your question's tags).