Closed tuxmaster5000 closed 1 month ago
This library and python-gssapi doesn't have the logic for what TGT is used in an authentication request. What happens is the username "name" and the service "name" is provided to the C library which does all the Kerberos logic. The username "name" is provided through the gssapi.Credentials
whereas the service "name" either provided explicitly through the target_name
kwarg or built from the hostname of the first response.
Basically the default SPN used will be f"HTTP@{urlparse(response.url).hostname}"
and that is what will be provided to GSSAPI. The actual logic for selecting what to use for the TGT is all inside the C library so you can specify a custom SPN through the target_name
kwarg but how that SPN is used is up to the C library and how it reads the configuration.
The HTTP request will not been made as you can see in the log. Of course this will be the second step after getting the TGT. But the TGT parts fails.
The default operation for this library is to make the HTTP request and then handle the authentication on the first 401 response from the server.
You can set opportunistic_auth=True
as a kwarg to build the auth header before the request but it's also going to just use the hostname of the request as part of the SPN to target. As I said this library doesn't do anything special to build the SPN. It simply takes the hostname from either the request or response and uses http@hostname
which is provided to the C library. If that is producing the wrong mapping then your either need to configure the /etc/krb5.conf
to map that hostname in some way to the realm it needs.
After debug with wire shark I found the problem. The underlying library was doing the call to can wrong KDC.
What went wrong?
I have an multiple realm environment with the realms:
Using BAR.NET will working as expected, but using FOO.BAR.NET will result in an realm mix. Instant of krbtgt/FOO.BAR.NET@FOO.BAR.NET, krbtgt/BAR.NET@FOO.BAR.NET is requested for the TGT
How do we reproduce?
sample code:
Client component versions (requests-gssapi, Kerberos, OS / distro, etc.)
OS: Fedora-39 requests-gssapi: python3-requests-gssapi-1.2.3-9.fc39.noarch
Realm config:
KRB5_TRACE: