sspilib

What it is and what it does

sspilib is a Python wrapper around the Windows SSPI (Security Support Provider Interface) API, exposing both high-level and low-level interfaces for Kerberos, NTLM, and Negotiate authentication. It allows Python applications to perform Windows-native authentication, establish security contexts, and encrypt/decrypt messages using the same cryptographic mechanisms as Windows itself.

The library is designed for scenarios where your Python application needs to authenticate against Windows servers or services using domain credentials—such as HTTP clients connecting to servers with Negotiate authentication, LDAP clients, or custom protocols. It ships with pre-built wheels for Windows, macOS, and Linux (x86_64 and aarch64), eliminating the need to compile from source in most cases. The high-level API provides familiar Python classes like UserCredential and ClientSecurityContext; the low-level raw API exposes individual SSPI functions for fine-grained control.

Use it for:

• Authenticate Python HTTP clients against Windows servers using Negotiate or Kerberos (e.g., corporate intranet APIs)
• Build LDAP clients that authenticate with Windows domain credentials
• Implement custom protocols that require SSPI-based authentication and message encryption
• Wrap sensitive data sent over untrusted channels using SSPI's message protection (wrap/unwrap)
• Integrate Python services into Windows-centric enterprise environments requiring Kerberos or NTLM

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides Python bindings to the Windows SSPI API for authentication and message protection, with experimental support for Linux and macOS via sspi-rs.

Yes, if you need Windows SSPI authentication in Python and are working in a Windows-centric environment. The pre-built wheels make installation painless, the MIT license is unrestricted, and there are no known vulnerabilities. However, the project is aging (254 days since last release, 8 stars), so adoption is limited and you should verify that the specific authentication protocols and scenarios you need are fully supported. For non-Windows platforms, the experimental sspi-rs backend is not recommended for production without thorough testing.

Install

sspilib on PyPI

pip install sspilib

uv add sspilib

poetry add sspilib

Installing sspilib

Before you install

Medium install friction due to compiled extensions; wheels are pre-built for Python 3.9+ on Windows, macOS (x86_64 and ARM64), and Linux (x86_64 and aarch64), so binary installation is straightforward. Repository shows active maintenance with a recent commit on 2025-12-03, though the project is aging and has limited adoption (8 stars).

License in practice

MIT license is permissive and imposes no restrictions on use, modification, or distribution in proprietary or open-source projects.

Quickstart

pip install sspilib

import sspilib

cred = sspilib.UserCredential("username@DOMAIN.COM", "password")
ctx = sspilib.ClientSecurityContext(
    credential=cred,
    target_name="host/server.domain.com",
)
while not ctx.complete:
    out_token = ctx.step(None)
    if out_token:
        in_token = exchange_with_server(out_token)

Requires Python 3.9+; SSPI is a Windows API, though experimental wheels exist for Linux and macOS using sspi-rs (glibc only, not musl/Alpine).

Verify before relying

• Whether the experimental non-Windows support (via sspi-rs) is production-ready or suitable for critical authentication workflows
• Performance characteristics and overhead of the high-level vs. raw API interfaces
• Completeness of SSPI API coverage and which specific authentication protocols are fully supported

Package facts

Evidence: sspilib-0.5.0-cp310-cp310-macosx_10_12_x86_64.whl; sspilib-0.5.0-cp310-cp310-macosx_11_0_arm64.whl; sspilib-0.5.0-cp310-cp310-manylinux_2_28_aarch64.whl; sspilib-0.5.0-cp310-cp310-manylinux_2_28_x86_64.whl; sspilib-0.5.0-cp310-cp310-win32.whl; sspilib-0.5.0-cp310-cp310-win_amd64.whl; sspilib-0.5.0-cp310-cp310-win_arm64.whl; sspilib-0.5.0-cp311-abi3-macosx_10_12_x86_64.whl; sspilib-0.5.0-cp311-abi3-macosx_11_0_arm64.whl; sspilib-0.5.0-cp311-abi3-manylinux_2_28_aarch64.whl; sspilib-0.5.0-cp311-abi3-manylinux_2_28_x86_64.whl; sspilib-0.5.0-cp311-abi3-win32.whl; sspilib-0.5.0-cp311-abi3-win_amd64.whl; sspilib-0.5.0-cp311-abi3-win_arm64.whl; sspilib-0.5.0-cp314-cp314t-macosx_10_15_x86_64.whl; sspilib-0.5.0-cp314-cp314t-macosx_11_0_arm64.whl; sspilib-0.5.0-cp314-cp314t-manylinux_2_28_aarch64.whl; sspilib-0.5.0-cp314-cp314t-manylinux_2_28_x86_64.whl; sspilib-0.5.0-cp314-cp314t-win32.whl; sspilib-0.5.0-cp314-cp314t-win_amd64.whl

Keywords: sspi, kerberos, negotiate

Tags

More Security packages