Version 0.9.0 with Linux doesn't Authenticate using Kerberos #208
Labels
Comments
|
Two things stand out - first: Looks like there's a .env file in your folder with something in it. Not sure if that's distracting the configuration. Second: Looks like you have no username configured for px to use for kerberos auth. Can you share what your config looks like without any personal info? |
|
I saw that too, couldn't find anything wrong. As far as I know ,SSPI is windows only. On linux GSSAPI should be used. My config: |
|
I found it in handler.py. I'll send a MR, it's an easy fix. |
|
Thanks for the PR though we need to make it a bit smarter to detect if GSSAPI is available via curl. I test px on several setups and GSSAPI is not available on many of them. Same applies on Windows too - it should check for SSPI before setting username to Meanwhile, I am also working on migrating px to use mcurl which was extracted out of this project and made standalone. I made sure those binaries include GSSAPI so we can be assured that it will always be available once we move. Just need additional changes to check for availability. |
|
Just by the way, similar issues on Windows: @genotrance , are you aware of curl/curl#13056? currently, it needs a manual update of curl for Windows in px-0.9.2 in order to get SSPI, Kerberos and SPNEGO working again on Windows platform - so please definitely update curl for Windows with the next px release... thx a million! 😃 |
|
oops, sorry - turns out I completely missed the 0.9.2 release so far... 😞 so everything should be fine again for Windows as wrt this comment... |
|
Can someone please help me to find some documentation on how this HTTP server principal is created for keytab I guess I am still missing that bit |
I have to object partially here. SSPI Is available, but you do not have a Kerberos Ticket/Login if you're not in a Windows Domain. Curl still will have "CURL_VERSION_SSPI" set to "True", because it is build with support for it. Either of GSS-API or SSPI is fine. To detect if there is a TGT and an Available serviceprincipal for "HTTP/proxyname@DOMAIN" without an additional lib would be hard if possible at all. I didn't deep dive, but I think curl just tries to get the Token for the service from os and fails to auth, if it doesn't get it. |
|
I'll use the libcurl docs to cover all relevant scenarios. Looks like we need to check GSS-API, NTLM, SPNEGO and SSPI. Checking for username is not required since libcurl will automatically use current credentials. If it fails, we will need to detect the failure from libcurl and log that. If user does not provide a username, we will attempt single sign-on if it is possible via libcurl. Else user will have to provide both username and password. |
|
Hello, After digging in source, I managed to workaround this issue by running Px this way : PX_PASSWORD="" px --pac=pacfile.pac --auth=ONLYNEGOTIATE --verbose --username=:My explanations:
When launching Px this way, I'm able to call resources while authenticating using Kerberos through GSSAPI: Doing a curl request generates this output: My env:
|
|
@florentcpt - can you please try this with Px v0.10.0? I am not able to get negotiate working in my Linux setup which is holding back this fix. |
|
I can confirm that the workaround of @florentcpt also works with 10.0. Init Prozess 5: The Request |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hello,
First thanks for this amazing project, i use it on a daily bases.
Hello,
The Version 0.9.0 doesn't work for me anymore. px doesn't Authenticate with Kerberos anymore.
I'm on an Arch Linux with python 3.11.6 for px. PX has it's own venv
The curl for the request with http_proxy set to localhost:3128
The curl with 0.8.4 same config:
Curl itself works with this setting if the company Proxy is set via http_proxy
I don't know where to look.
Any Ideas
The text was updated successfully, but these errors were encountered: