---
id: pykerberos
version: "1.2.4"
license: ASL 2.0
license_treatment: permissive
maintenance: abandoned
---

# pykerberos — High-level interface to Kerberos

License: permissive · Maintenance: abandoned · Downloads: 2.0M/mo

## What it is and what it does

PyKerberos is a high-level Python wrapper around Kerberos (GSSAPI) that abstracts the complexity of building full Kerberos bindings. It provides a limited set of functions for client and server authentication based on RFC 4559, with support for channel bindings that allow authentication to be bound to specific data channels (useful for TLS and services requiring Extended Protection).

The package requires system-level Kerberos libraries to compile and function, and depends on a properly configured Kerberos environment with valid tickets or keytab entries. However, the maintainers have placed this fork on life support, explicitly recommending users try the upstream package instead, as Apple has resumed work on the original project.

Use it for:

- Implement Kerberos authentication in Python applications that need to authenticate against Active Directory or MIT Kerberos realms.
- Build client applications that negotiate Kerberos tokens with servers using GSSAPI for single sign-on integration.
- Add channel binding support to TLS-authenticated services to meet Extended Protection requirements.
- Develop server-side Kerberos service principals that validate incoming client authentication tokens.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Provides a Python wrapper for Kerberos (GSSAPI) authentication, enabling client and server authentication based on RFC 4559 with support for channel bindings.

No. The package is abandoned (last release 2022-03-09) and its own documentation recommends using the upstream package instead. High install friction from C compilation requirements, combined with no active maintenance, makes this a poor choice for new projects. Only consider if maintaining legacy code already using this specific fork.

## Install

pip install pykerberos
uv add pykerberos
poetry add pykerberos

## Installing pykerberos

Before you install: High install friction due to compiled C extensions requiring system Kerberos libraries. Package is in abandoned maintenance status with no releases since 2022-03-09; the description explicitly recommends using the upstream package instead.

License in practice: Licensed under ASL 2.0 (permissive), allowing commercial and private use with minimal restrictions.

Quickstart:

pip install pykerberos
import pykerberos
result, context = pykerberos.authGSSClientInit('http@host.example.com')
pykerberos.authGSSClientStep(context, neg_resp_value)

Requires system Kerberos libraries and valid Kerberos configuration; C extensions must compile during installation.

Verify before relying:

- Whether this fork remains compatible with modern Kerberos versions given its abandoned status since 2022-03-09.
- Current Python 3 compatibility level, as classifiers claim support but package is not actively maintained.
- Whether the recommended upstream package is a direct drop-in replacement or requires code changes.

## Package facts

- License: ASL 2.0 (permissive)
- Python support: unspecified
- Install friction: high
- Maintenance: abandoned
- Downloads: 2.0M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

kerberos authentication python, gssapi wrapper, kerberos client server, channel bindings authentication, kerberos spn negotiation, kerberos ticket validation, authentication, kerberos, gssapi

[View on SkillFed](https://skillfed.io/packages/pykerberos) · [View on PyPI](https://pypi.org/project/pykerberos/)