---
id: winkerberos
version: "0.13.0"
license: Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for… (full text in the JSON record)
license_treatment: permissive
maintenance: active
---

# winkerberos — High level interface to SSPI for Kerberos client auth

License: permissive · Maintenance: active · Downloads: 4.3M/mo

## What it is and what it does

WinKerberos is a native Kerberos client library for Windows that implements GSSAPI authentication using Microsoft's Security Support Provider Interface (SSPI). It mimics the API of pykerberos to provide a familiar interface for developers, but uses Windows' built-in Kerberos support rather than a separate implementation. The package handles the full SASL authentication handshake—initialization, challenge-response loops, wrapping/unwrapping of encrypted data, and channel binding for TLS—making it suitable for applications that need to authenticate against Kerberos-protected services from Windows.

The package is actively maintained and supports Python 3.10 through 3.14 on both 32-bit and 64-bit Windows. It has no external runtime dependencies beyond the Windows operating system itself. Installation is straightforward via pip when prebuilt wheels are available; building from source requires Visual Studio 2015 or newer. The API is documented through docstrings and examples in the repository, and the package is used in production by MongoDB and other projects requiring Windows-based Kerberos authentication.

Use it for:

- Authenticate Python applications against Active Directory or Kerberos-protected services on Windows without external Kerberos libraries.
- Integrate Kerberos authentication into Windows-based microservices or database drivers that need SASL/GSSAPI support.
- Implement single sign-on (SSO) flows in Windows desktop or server applications using the user's existing Kerberos credentials.
- Add channel binding support to TLS connections for enhanced security in Windows environments.
- Replace or supplement pykerberos in Windows-only deployments where native SSPI integration is preferred.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Provides native Kerberos client authentication on Windows by wrapping Microsoft's SSPI, with an API compatible with pykerberos for GSSAPI-based authentication flows.

Yes, if you are on Windows and need Kerberos authentication. The package is actively maintained, has no external dependencies, carries a permissive license, and provides a straightforward API. Install friction is moderate due to compiled wheels, but prebuilt binaries are available for modern Python versions. Not applicable on non-Windows platforms.

## Install

pip install winkerberos
uv add winkerberos
poetry add winkerberos

## Installing winkerberos

Before you install: Medium friction due to compiled binary wheels required for Windows. Prebuilt wheels available for Python 3.10–3.14 on both 32-bit and 64-bit Windows. If building from source, Visual Studio 2015 or newer is required. Package is actively maintained with recent releases.

License in practice: Licensed under Apache License 2.0 (permissive). You may use, modify, and distribute the package freely in commercial and private projects, provided you include a copy of the license and document any changes you make.

Quickstart:

import winkerberos as kerberos

status, ctx = kerberos.authGSSClientInit('service@host')
status = kerberos.authGSSClientStep(ctx, '')
response = kerberos.authGSSClientResponse(ctx)

Windows 7 / Windows Server 2008 R2 or newer required; Python 3.10+; requires SSPI support on the system.

Verify before relying:

- Whether the package works on non-domain-joined Windows systems or requires Active Directory integration.
- Support status for Python 3.14 (wheels are present but release notes do not explicitly confirm support).
- Performance characteristics or known limitations when handling large authentication payloads.

## Package facts

- License: Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for… (full text in the JSON record) (permissive)
- Python support: supports_current
- Install friction: medium
- Maintenance: active
- Downloads: 4.3M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

windows kerberos authentication, sspi gssapi client, kerberos windows python, windows active directory auth, kerberos client sspi, gssapi windows implementation, kerberos sasl windows, windows-only, authentication, kerberos

[View on SkillFed](https://skillfed.io/packages/winkerberos) · [View on PyPI](https://pypi.org/project/winkerberos/)