or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

credentials.mdextensions.mdindex.mdnames.mdraw-api.mdsecurity-contexts.md
tile.json

tessl/pypi-gssapi

Python GSSAPI wrapper providing both low-level C-style and high-level Pythonic interfaces for Kerberos and other authentication mechanisms

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
pypipkg:pypi/gssapi@1.10.x

To install, run

npx @tessl/cli install tessl/pypi-gssapi@1.10.0

index.mddocs/

Python GSSAPI

Python GSSAPI provides comprehensive bindings for the Generic Security Service Application Program Interface (GSSAPI), offering both low-level C-style API wrappers that closely match RFC 2744 specifications and high-level Pythonic interfaces for easier integration. The library primarily focuses on Kerberos authentication mechanisms while supporting other GSSAPI mechanisms, includes extensive RFC extensions, provides credential management, security context handling, and message protection capabilities.

Package Information

  • Package Name: gssapi
  • Language: Python
  • Installation: pip install gssapi
  • Dependencies: decorator
  • Python Version: 3.9+

Core Imports

import gssapi

For high-level API classes (recommended):

from gssapi import Name, Credentials, SecurityContext, Mechanism

For low-level raw API access:

import gssapi.raw
from gssapi.raw import names, creds, sec_contexts, message

Basic Usage

import gssapi

# Create a name from a string
name = gssapi.Name('service@hostname.example.com')

# Acquire credentials
creds = gssapi.Credentials(name=name, usage='initiate')

# Initiate a security context
ctx = gssapi.SecurityContext(
    name=gssapi.Name('target@hostname.example.com'),
    creds=creds,
    usage='initiate'
)

# Perform the authentication handshake
token = None
while not ctx.complete:
    token = ctx.step(token)
    if token:
        # Send token to acceptor and receive response
        pass

# Wrap and unwrap messages
message = b"Hello, GSSAPI!"
wrapped = ctx.wrap(message, encrypt=True)
unwrapped = ctx.unwrap(wrapped.message)

Architecture

Python GSSAPI is structured in two primary layers:

  • High-Level API (gssapi): Object-oriented Pythonic interface with automatic memory management, providing classes for Name, Credentials, SecurityContext, and Mechanism operations.
  • Low-Level API (gssapi.raw): Direct C-style bindings matching RFC 2744 specifications, organized into modules for names, credentials, security contexts, messages, and various RFC extensions.

The high-level classes inherit from low-level classes, enabling interoperability between the two APIs. Extensions are dynamically loaded based on GSSAPI implementation support.

Capabilities

Names and Name Management

Name creation, canonicalization, comparison, and RFC 6680 naming extensions for attribute-based name handling and composite name operations.

class Name:
    def __new__(cls, base=None, name_type=None, token=None, composite=False): ...
    def canonicalize(self, mech): ...
    def __str__(self): ...
    def __bytes__(self): ...

Names and Name Management

Credential Management

Credential acquisition, delegation, impersonation, import/export, and credential store operations with support for various authentication mechanisms.

class Credentials:
    def __new__(cls, base=None, token=None, name=None, lifetime=None, mechs=None, usage='both', store=None): ...
    @classmethod
    def acquire(cls, name=None, lifetime=None, mechs=None, usage='both', store=None): ...
    def add(self, name=None, mech=None, usage='both', init_lifetime=None, accept_lifetime=None): ...

Credential Management

Security Context Operations

Security context initiation, acceptance, message protection (wrap/unwrap), MIC operations, and context inquiries for secure communication channels.

class SecurityContext:
    def __new__(cls, base=None, token=None, name=None, creds=None, lifetime=None, flags=None, mech=None, channel_bindings=None, usage=None): ...
    def step(self, token=None): ...
    def wrap(self, message, encrypt=None): ...
    def unwrap(self, message, message_buffer=None): ...

Security Context Operations

Low-Level Raw API

Direct C-style GSSAPI bindings following RFC 2744 specifications, providing fine-grained control over GSSAPI operations and access to all extension functions.

def acquire_cred(desired_name=None, lifetime=None, desired_mechs=None, cred_usage=None, store=None): ...
def init_sec_context(creds, context=None, target_name=None, mech=None, req_flags=None, time_req=None, channel_bindings=None, input_token=None): ...
def accept_sec_context(creds, context=None, input_token=None, channel_bindings=None): ...

Low-Level Raw API

Mechanism Management

GSSAPI mechanism handling, inspection, and selection with support for mechanism attributes and capabilities inquiry.

class Mechanism(gssapi.raw.oids.OID):
    def __new__(cls, cpy=None, elements=None): ...
    @property
    def name_types(self): ...
    @property
    def sasl_name(self): ...  # requires RFC 5801
    @property
    def description(self): ...  # requires RFC 5801
    @property
    def known_attrs(self): ...  # requires RFC 5587
    @property
    def attrs(self): ...  # requires RFC 5587
    @classmethod
    def all_mechs(cls): ...
    @classmethod
    def from_name(cls, name): ...
    @classmethod
    def from_sasl_name(cls, name): ...  # requires RFC 5801
    @classmethod
    def from_attrs(cls, desired_attrs=None, except_attrs=None, critical_attrs=None): ...  # requires RFC 5587

Extensions and RFCs

Support for numerous GSSAPI extensions including RFC 4178 (Negotiation), RFC 5587 (Mechanism Inquiry), RFC 5588 (Credential Store), RFC 5801 (SASL), RFC 6680 (Naming Extensions), Services4User, DCE/IOV operations, and Kerberos-specific extensions.

# Extension availability varies by GSSAPI implementation
from gssapi.raw.ext_s4u import acquire_cred_impersonate_name
from gssapi.raw.ext_rfc5588 import store_cred
from gssapi.raw.ext_rfc6680 import display_name_ext, get_name_attribute

Extensions and RFCs

Types

from gssapi.raw.types import NameType, RequirementFlag, AddressType, MechType, IntEnumFlagSet
from gssapi.raw.oids import OID

class NameType:
    hostbased_service: OID
    user: OID  # user_name
    machine_uid: OID  # machine_uid_name  
    string_uid: OID  # string_uid_name
    anonymous: OID
    export: OID
    composite_export: OID  # RFC 6680 extension
    kerberos_principal: OID  # Kerberos-specific principal name

class RequirementFlag(IntEnumFlagSet):
    delegate_to_peer: int
    mutual_authentication: int
    replay_detection: int
    out_of_sequence_detection: int  # sequence_detection
    confidentiality: int
    integrity: int
    anonymity: int  # anonymous
    protection_ready: int
    transferable: int  # transfer_ready
    ok_as_delegate: int  # deleg_policy_flag
    channel_bound: int

class MechType:
    kerberos: OID
    spnego: OID