Metadata-Version: 2.4
Name: lexmount-extra
Version: 0.1.2
Summary: Extra utilities for Lexmount Python SDK projects.
Author: lexmount
License: MIT
Project-URL: Homepage, https://dev.lexmount.net/
Project-URL: Documentation, https://dev.lexmount.net/docs
Keywords: lexmount,sdk,ntlm,kerberos,spnego
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Operating System :: OS Independent
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: lexmount>=0.5.2
Requires-Dist: ntlm-auth>=1.5.0
Requires-Dist: pyspnego>=0.11.2; sys_platform == "win32"
Requires-Dist: pyspnego[kerberos]>=0.11.2; sys_platform != "win32"
Requires-Dist: pycryptodome>=3.20.0
Provides-Extra: dev
Requires-Dist: pytest>=7.0.0; extra == "dev"
Requires-Dist: build>=1.0.0; extra == "dev"
Dynamic: license-file

# lexmount-extra

Extra utilities for Lexmount Python SDK projects.

## Install

```sh
pip install lexmount-extra
```

The package uses `ntlm-auth` for non-Windows NTLM credentials, `pyspnego` for
Windows SSPI-backed Kerberos/NTLM, `pyspnego[kerberos]` for non-Windows
Kerberos, and `pycryptodome` as an MD4 fallback for Python/OpenSSL builds that
do not expose `hashlib.new("md4")`.

On non-Windows Debian/Ubuntu images, installing the Kerberos dependency may
also require the system package that provides `krb5-config`:

```sh
sudo apt-get install libkrb5-dev
```

## Usage

```py
from lexmount_extra import (
    createKerberosAuthCallback,
    createNTLMAuthCallback,
    generateKerberosToken,
    generateNTLMChallengeToken,
    generateNTLMResponseToken,
)

type1_token = generateNTLMChallengeToken("web.lab.local", "LAB")

type3_token = generateNTLMResponseToken(
    "http://web.lab.local/",
    "web.lab.local",
    "LAB",
    "NTLM <server-type2-token>",
    "alice",
    "P@ssw0rd123!",
)

kerberos_token = generateKerberosToken(
    "HTTP@web.lab.test",
    "server-token",
)
```

Pythonic snake_case aliases are available for every Node-compatible camelCase
function.

## Lexmount authentication callbacks

```py
from lexmount import register_integrated_auth_callback
from lexmount_extra import createKerberosAuthCallback, createNTLMAuthCallback

ntlm_auth = createNTLMAuthCallback({
    "hostname": "web.lab.local",
    "domain": "LAB",
})

kerberos_auth = createKerberosAuthCallback({
    "hostname": "web.lab.test",
})

register_integrated_auth_callback(session, ntlm_auth)
register_integrated_auth_callback(session, kerberos_auth)
```

Both callback factories can be called without options. NTLM defaults to
`USERDNSDOMAIN` and `USERDOMAIN` when those environment variables exist.
Kerberos derives the `HTTP@host` service principal off Windows or `HTTP/host`
on Windows from the authentication challenge origin when neither `spn` nor
`hostname` is provided.

## Kerberos integrated authentication

Windows Kerberos generation uses SSPI through `pyspnego`, avoiding the
non-Windows `gssapi` dependency. Non-Windows platforms continue to use
`gssapi` through `pyspnego[kerberos]`.

## NTLM integrated authentication

Windows NTLM generation uses SSPI through `pyspnego`. Type 1 and Type 3 tokens
both support explicit `username`/`password` credentials, and Type 3 can also
use the current Windows logon session when credentials are omitted. The Lexmount
callback keeps the SSPI context between Type 1 and Type 3 by using the request's
`frameId` and `requestId`.

Non-Windows platforms use `ntlm-auth`. They support Type 1 and Type 3 with
explicit `username`/`password` credentials; Type 3 without credentials returns
an empty token.
