Support for Kerberos Authentication

[boombard]

Does this library support Kerberos Authentication at all? If not, are there any plans to support it in the future?

[adetorcy]

Not at this point but depending on the level of interest it could be added (as well as #8), after iRODS 4.2 is released.

[boombard]

If you point me in the right direction I can try it myself and make a pull request? Is it a matter of changing the RODS_API_REQ message?

[adetorcy]

Correct. You are going to need different Connection._login() methods based on irods_authentication_scheme in the client environment. In C++ both the client and server-side Kerberos authentication functionality is provided by the Kerberos plugin so you will need to implement the client side of the plugin in Python. I would start by looking at clientLogin.cpp to see what the overall authentication flow is, and then implement python versions of the client plugin operations in libkrb.cpp, which are called in clientLogin(). Thanks a lot for offering to help with this.

[kript]

This is useful for Sanger (as @boombard is a Sanger person).

[kript]

bump . :-)

[pdonorio]

@boombard you might want to take a look at the new gsi login we just implemented, which should be pretty similar to Kerberos.

We based our handshake on the python gssapi library which covers with their basic tutorial the kerberos use case.

Good luck!

[trel]

@cmeesters is interested in kerberos integration. any updates anyone?

[cmeesters]

What would be required to get the kerberos integration: In terms of enviroment, feedback, tests, code?

Perhaps I am naive, but I think there are two alternative options for implementing:

• Either look for an existing kerberos ticket and cowardly refuse to work when there is none (by raising an appropriate error). This assume a non-interactive workflow from the client script.
• Or ask for a passwd when there is no ticket. This would require an interactive part in the client script.

Personally, option 1 is just fine. But, as I said, perhaps a bit naive as I am unaware of additional requirements.

[trel]

The GSI commits were from January 2017 -- #56 and #57

[erdc-cv19]

No progress on this so far?

[trel]

The iRODS server has dropped direct Kerberos support, but Kerberos can be supported via the PAM stack.

This library supports a PAM flow with the iRODS server, so it would be interesting to show this is working with a Kerberized PAM configuration.

[alanking]

I'm not sure how it works for 4.2, but in 4.3.2+, one can use pam_interactive to achieve PAM-based Kerberos authentication with iRODS: https://github.com/irods/irods_auth_plugin_pam_interactive?tab=readme-ov-file#kerberos-authentication This would of course require the pam_interactive plugin implementation for this client, but just thought I'd point that out.

Not sure how Kerberos auth works for 4.2.x. The Kerberos auth plugin was not ported to 4.3.x.

[d-w-moore]

I'm not sure how it works for 4.2, but in 4.3.2+, one can use pam_interactive to achieve PAM-based Kerberos authentication with iRODS: https://github.com/irods/irods_auth_plugin_pam_interactive?tab=readme-ov-file#kerberos-authentication.

This would of course require the pam_interactive plugin implementation for this client, but just thought I'd point that out. <...snip>

pam_interactive is slated to happen soon, I believe: #653