2

I am trying to do authentication with Kerberos and the Python flask-kerberos module. Basically this is my code:

DEBUG=True

app = Flask(__name__)
app.config.from_object(__name__)

os.environ['KRB5_KTNAME'] = "/home/myuser/Python3/KerberosAuthSSO"


@app.route("/")
@requires_authentication
def protected_view(user):
        os.environ['KRB5_KTNAME'] = "/home/myuser/Python3/KerberosAuthSSO/flask-sso.keytab"
        userinfo["user"] = user
        return jsonify(userinfo)

if __name__ == '__main__':
    init_kerberos(app)
    app.run(host='0.0.0.0')

This my userPrincipalName and servicePrincipalName in Active Directory for the user: enter image description here

And this is what my Keytab looks like.

server.my.domain.com:~ # /usr/bin/klist -k -t /home/myuser/Python3/KerberosAuthSSO/flask-sso.keytab
Keytab name: FILE:/home/myuser/Python3/KerberosAuthSSO/flask-sso.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   4 01/01/70 01:00:00 HTTP/server.my.domain.com@DOMAIN.COM
   4 01/01/70 01:00:00 HTTP/server.my.domain.com@DOMAIN.COM
   4 01/01/70 01:00:00 HTTP/server.my.domain.com@DOMAIN.COM
   4 01/01/70 01:00:00 HTTP/server.my.domain.com@DOMAIN.COM
   4 01/01/70 01:00:00 HTTP/server.my.domain.com@DOMAIN.COM

However, when I run the app I get the following error:

Traceback (most recent call last):
  File "/usr/lib/python3.4/site-packages/flask_kerberos.py", line 33, in init_kerberos
    principal = kerberos.getServerPrincipalDetails(service, hostname)
kerberos.KrbError: ('Cannot get sequence cursor from keytab', 21)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "__init__.py", line 26, in <module>
    init_kerberos(app, hostname="server.my.domain.com@DOMAIN.COM")
  File "/usr/lib/python3.4/site-packages/flask_kerberos.py", line 35, in init_kerberos
    app.logger.warn("Kerberos: %s" % exc.message[0])
AttributeError: 'KrbError' object has no attribute 'message'

Unfortunately, I cannot figure out what is causing this error.

Kai78
  • 47
  • 1
  • 6
  • Is the Kerberos realm here COOP.CH or DOMAIN.COM??? Be consistent if you are going to mask the actual names. – T-Heron Jul 19 '20 at 03:12

1 Answers1

0

If you are on HTTPd, don't waste your time, use https://github.com/gssapi/mod_auth_gssapi. The remote user will be available via Werkzeug/Flask.

<Location /foo>
  AuthType GSSAPI
  AuthzSendForbiddenOnFailure On
  Require valid-user # Require user michael-o@EXAMPLE.COM
</Location>
Michael-O
  • 18,123
  • 6
  • 55
  • 121