使用Kerberos的单点登录

问题描述

我正在尝试使用Kerberos和Python flask-kerberos模块进行身份验证。 基本上这是我的代码：

DEBUG=True

app = Flask(__name__)
app.config.from_object(__name__)

os.environ['KRB5_KTNAME'] = "/home/myuser/Python3/KerberosAuthSSO"


@app.route("/")
@requires_authentication
def protected_view(user):
        os.environ['KRB5_KTNAME'] = "/home/myuser/Python3/KerberosAuthSSO/flask-sso.keytab"
        userinfo["user"] = user
        return jsonify(userinfo)

if __name__ == '__main__':
    init_kerberos(app)
    app.run(host='0.0.0.0')

这是该用户在Active Directory中的My userprinalName和serviceprinalName(我的用户原则名称和服务原则名称)：

这就是我的Keytab的外观。

server.my.domain.com:~ # /usr/bin/klist -k -t /home/myuser/Python3/KerberosAuthSSO/flask-sso.keytab
Keytab name: FILE:/home/myuser/Python3/KerberosAuthSSO/flask-sso.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   4 01/01/70 01:00:00 HTTP/server.my.domain.com@DOMAIN.COM
   4 01/01/70 01:00:00 HTTP/server.my.domain.com@DOMAIN.COM
   4 01/01/70 01:00:00 HTTP/server.my.domain.com@DOMAIN.COM
   4 01/01/70 01:00:00 HTTP/server.my.domain.com@DOMAIN.COM
   4 01/01/70 01:00:00 HTTP/server.my.domain.com@DOMAIN.COM

但是，当我运行该应用程序时，我收到以下错误：

Traceback (most recent call last):
  File "/usr/lib/python3.4/site-packages/flask_kerberos.py", line 33, in init_kerberos
    principal = kerberos.getServerPrincipalDetails(service, hostname)
kerberos.KrbError: ('Cannot get sequence cursor from keytab', 21)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "__init__.py", line 26, in <module>
    init_kerberos(app, hostname="server.my.domain.com@DOMAIN.COM")
  File "/usr/lib/python3.4/site-packages/flask_kerberos.py", line 35, in init_kerberos
    app.logger.warn("Kerberos: %s" % exc.message[0])
AttributeError: 'KrbError' object has no attribute 'message'

很遗憾，我找不到导致此错误的原因。

---

解决方案

如果您在使用HTTPd，请不要浪费时间，请使用https://github.com/gssapi/mod_auth_gssapi。可以通过Werkzeug/Flask联系到远程用户。

<Location /foo>
  AuthType GSSAPI
  AuthzSendForbiddenOnFailure On
  Require valid-user # Require user michael-o@EXAMPLE.COM
</Location>