[python-ldap] Is it possible to bind using a kerberos keytab

[Michael Ströder]

Rob McBroom wrote:
> On 23 Dec 2014, at 11:23, Kev SMITH wrote:
> 
>> I am trying to bind to windows 2003 AD using a keytab - my code successfully
>> initialises the keytab, the ldap options but I just can not seem to get the
>> bind to work using a keytab.
>> Is this type of authentication supported?
> 
> Yes. I used to use it all the time, and while it would work with something
> like MIT Kerberos, I could never get it to work against AD. (We were on 2008.
> You might have better luck with 2003.)

I can confirm that this simply works provided your Kerberos setup in correct
at client and server side. With MS AD you have to carefully examine DNS
entries. Most times bad DNS entries are the culprit for non-functional Kerberos.

>     auth_tokens = ldap.sasl.gssapi()
>     adconn.sasl_interactive_bind_s('', auth_tokens)
> 
> That will use an existing Kerberos ticket. (Don’t ask me how, because the
> `auth_tokens` object is identical with or without a ticket.)

Mainly the SASL library does all the magic under the hood if you have the
GSSAPI SASL plugin module installed.

Ciao, Michael.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4252 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://mail.python.org/pipermail/python-ldap/attachments/20141225/55663560/attachment.bin>