Metadata-Version: 2.4
Name: oarepo-kerberos
Version: 0.1.0
Summary: A library for Kerberos integration in OARepo.
Project-URL: Homepage, https://github.com/oarepo/oarepo-kerberos
Requires-Python: <3.15,>=3.14
Requires-Dist: flask-gssapi
Requires-Dist: oarepo<15,>=14.2.1b11.dev1
Provides-Extra: dev
Requires-Dist: ruff; extra == 'dev'
Provides-Extra: oarepo14
Requires-Dist: oarepo[rdm,tests]<15.0.0,>=14.0.0; extra == 'oarepo14'
Provides-Extra: tests
Requires-Dist: oarepo-model; extra == 'tests'
Requires-Dist: pytest-flask; extra == 'tests'
Requires-Dist: pytest-invenio; extra == 'tests'
Requires-Dist: pytest-oarepo; extra == 'tests'
Requires-Dist: pytest>=7.1.2; extra == 'tests'
Requires-Dist: requests-kerberos; extra == 'tests'
Description-Content-Type: text/markdown

# oarepo Kerberos

Library that handles the kerberos authentication

### Local Setup
Go to setup_local_kdc folder

1. docker build -t custom-kerberos-kdc .

2. docker run -d --name kerberos-kdc -p 2222:88 -p 2223:464 custom-kerberos-kdc

3. docker exec -it kerberos-kdc /bin/bash 

4. kadmin.local -q "addprinc admin/admin@EXAMPLE.COM" (choose password)

5. kadmin.local -q "addprinc user@EXAMPLE.COM" (choose password)

6. kadmin.local -q "addprinc -randkey HTTP/localhost@EXAMPLE.COM"

7. kadmin.local -q "ktadd -k /etc/krb5kdc/flask.keytab HTTP/localhost@EXAMPLE.COM"

8. docker cp kerberos-kdc:/etc/krb5kdc/flask.keytab ./flask.keytab

9. Setup env variable `KRB5_KTNAME` to location of flask.keytab and set `app.config['GSSAPI_HOSTNAME'] = 'localhost'`

10. change/create file `/etc/krb5.conf` to or `export KRB5_CONFIG=./setup_local_kdc/krb5-client.conf`:

```
[libdefaults]
    default_realm = EXAMPLE.COM
    dns_lookup_kdc = false
    dns_lookup_realm = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true

[realms]
    EXAMPLE.COM = {
        kdc = localhost:2222
        admin_server = localhost:2223
    }

[domain_realm]
    .example.com = EXAMPLE.COM
    example.com = EXAMPLE.COM

```

11. kinit user@EXAMPLE.COM or another username created in step 5

### Limitations

#### Multi-leg SPNEGO is not supported

Authentication must complete in a single round trip. The negotiation cannot
be resumed either — a fresh GSSAPI security context is built per request, and the continuation
token is discarded unless that context completed — so a request needing a second leg is answered
with **501 Not Implemented**.

#### A session cookie and a Negotiate token cannot be combined

Successful Kerberos authentication logs the user in, which sets a session cookie. If a client
then sends that cookie *and* `Authorization: Negotiate ...` on a later request, it is presenting
two credentials that may name different principals, so the server refuses with **400 Bad
Request** rather than silently picking one.





