<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<br>
<br>
Michael Ströder wrote:
<blockquote cite="mid:475E945D.7040407@stroeder.com" type="cite">
<pre wrap="">Geert Jansen wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Michael Ströder wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I saw that kinit is started as a shell sub-process.
</pre>
</blockquote>
<pre wrap="">Actually Python-AD comes with a C module that wraps the required
Kerberos functions (see lib/ad/protocol/krb5.c). What you probably saw
is the use of kinit in the test suite, where I use it to verify the
credentials acquired by the C module.
</pre>
</blockquote>
<pre wrap=""><!---->
Ah, ok. Interesting. Why don't you separate the krb5 module into another
project. I guess some people might be interested in that.
Especially my dream would be to support HTTP-Authentication based on
SPNEGO/GSSAPI in web2ldap. But not only authenticating the user at the
web server. I would rather like forward the service ticket requested for
a particular LDAP service to the LDAP server in a SASL/GSSAPI
BindRequest. Do you think that's feasible?
</pre>
</blockquote>
there is pykerberos from
<a class="moz-txt-link-freetext" href="http://trac.calendarserver.org/projects/calendarserver/browser/PyKerberos/">http://trac.calendarserver.org/projects/calendarserver/browser/PyKerberos/</a><br>
<br>
I am interested in a better GSSAPI binding for Python.. and have some
incomplete code locally if anyone else is interested.<br>
To do credential forwarding, the gss is currently kind of crappy about
how to extract creds portably, but if you know it's kerberos and you
can set KRB5CCNAME to a temporary file you can stash a delegated TGT
into a temp ccache so that SASL/GSS can find it when you talk ldap.<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
David Leonard <a class="moz-txt-link-abbreviated" href="mailto:d@adaptive-enterprises.com.au">d@adaptive-enterprises.com.au</a>
Ph:+61 404 844 850
</pre>
</body>
</html>