django-kerberos 1.1.0

Kerberos authentication for Django

Provide Kerberos authentication to Django applications.

Basic usage

Add this to your project urls.py:

url('^accounts/kerberos/', include('django_auth_kerb.urls')),

And use the default authentication backend, by adding that to your settings.py file:

AUTHENTICATION_BACKENDS = (
    'django_auth_kerberos.backends.KerberosBackend',
)

Settings

Custom backend

A custom authentication backend can be used, in this case the signature of the authenticate method must be:

class CustomKerberosBackend(object):
    def authenticate(self, principal=None):
        pass

Sample application

First you need to install django-kerberos into your environment like that:

python setup.py install

If you want to try the sample application you must add this line to your /etc/hosts file, absolutely at the beginning:

127.0.0.1 test.example.com

Then you must connect to your Kerberos administration server and add the principal HTTP/test.example.com and export its key in a keytab file:

$ kadmin -p myuser/admin
kadmin: addprinc -randkey HTTP/test.example.com
kadmin: ktadd -k /tmp/keytab HTTP/test.example.com

Finally you can run the sample:

cd sample; KRB5_KTNAME=FILE:/tmp/keytab python ./manage.py runserver

Now you should be able to login on http://test.example.com:8000/

The sample project is configured so that all principal ending with /admin get the staff and superuser flags. You can change that by editing the key KERBEROS_BACKEND_ADMIN_REGEXP in sample/sample/settings.py.

Pseudo hasher

A pseudo hasher whose import path is django_kerberos.hashers.KerberosHasher provide a mean to associate a Django user model to a Kerberos identity.

The content of the password field must be kerberos$<principal name>.

To create an user for a principal you can do:

User.objects.create(username=new_username, password='kerberos$' + principal)

Login/Password backend

If your users does not have their browser configured for SPNEGO HTTP authentication you can also provide a classic login/password form which check passwords using Kerberos.