kerberos

What it is and what it does

PyKerberos is a thin Python wrapper around the Kerberos/GSSAPI C libraries, designed to handle client and server authentication flows without requiring you to wrap the entire Kerberos framework yourself. It exposes a limited set of functions for initiating authentication contexts, stepping through the Kerberos handshake, and managing channel bindings for enhanced security. The package has no runtime Python dependencies and compiles against system Kerberos libraries.

The library is intended for applications that need to authenticate users or services using Kerberos tickets, such as web servers enforcing Kerberos-based SSO or internal tools integrating with Active Directory. It supports channel bindings (useful for meeting Microsoft Extended Protection requirements) and offers both client-side and server-side authentication primitives. However, the project is no longer maintained—the repository was archived after its final release in January 2021, and there have been no updates since.

Use it for:

• Authenticate HTTP clients against a Kerberos-protected web server using SPNEGO/Negotiate.
• Build a Kerberos-aware reverse proxy or gateway that validates incoming Kerberos tickets.
• Implement SSO integration in internal applications that rely on Active Directory or MIT Kerberos.
• Add channel binding support to TLS connections to meet enterprise security policies.
• Test Kerberos authentication flows in a development environment with a local KDC.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides a high-level Python wrapper for Kerberos (GSSAPI) authentication operations, enabling client and server Kerberos authentication based on RFC 4559.

No—do not install for new projects. The package is abandoned (last release January 2021, repository archived), carries at least one known security vulnerability (PYSEC-2017-49), and has medium install friction due to compiled C dependencies. If you must use Kerberos authentication in Python, evaluate actively maintained alternatives or consider using system-level Kerberos libraries directly. Only install if you are maintaining legacy code already depending on this package and cannot migrate.

Install

kerberos on PyPI

pip install kerberos

uv add kerberos

poetry add kerberos

Installing kerberos

Before you install

Medium install friction due to compiled C extensions requiring a Kerberos framework or development headers on the system. Repository is archived and last released in 2021, with no commits since February 2024—maintenance has ceased.

License in practice

Licensed under Apache License 2.0 (permissive), allowing commercial and private use with minimal restrictions, though you must retain license notices.

Quickstart

import kerberos

result, context = kerberos.authGSSClientInit('HTTP@example.com')
kerberos.authGSSClientStep(context, '')
kerberos.authGSSClientClean(context)

Requires a valid Kerberos installation (Kerberos framework on macOS, krb5 development headers on Linux) and a working KDC; not installable on systems without Kerberos infrastructure.

Verify before relying

• Whether the single known vulnerability (PYSEC-2017-49) has been patched or remains exploitable in version 1.3.1.
• Current compatibility with modern Python versions beyond those in the wheel filenames (cp27, cp38, cp39).
• Whether the checkPassword method's testing-only limitation affects real-world deployment scenarios.

Package facts

Evidence: kerberos-1.3.1-cp27-cp27m-macosx_11_1_x86_64.whl; kerberos-1.3.1-cp38-cp38-macosx_10_15_x86_64.whl; kerberos-1.3.1-cp39-cp39-macosx_10_9_x86_64.whl

Tags

More Python Modules packages