如何在Windows上安裝gssapi python模塊？

Question

我目前正在嘗試獲取適用於python的gssapi模塊在Windows上運行。 我的目標是使用python模塊ldap3向Active Directory進行身份驗證。 gssapi是這項工作的要求。 但是，安裝失敗，因為找不到krb5-config。 在Linux上很容易安裝 。 我為Windows安裝了Kerberos，但它沒有krb5-config，並且在其他任何地方（除了Linux）都找不到它。 有誰知道在哪里可以找到所需的工具或如何繼續（如果可能的話）？

Answer 1

以下@keithhendry的提議（ https://github.com/cannatag/ldap3/issues/190 ）我取代kerberos.py下ldap3\\protocol\\sasl\\與這一個 。

為了使用Windows的GSSAPI，您還需要安裝winkerberos軟件包並替換kerberos.py中第15行的kerberos導入，如下所示：

import winkerberos as kerberos

這是透明的，因為winkerberos與pykerberos遵循相同的API結構，而kerberos.py就是基於pykerberos的。

現在，在使用authentication=SASL, sasl_mechanism=GSSAPI構建Connection時authentication=SASL, sasl_mechanism=GSSAPI可以使用authentication=SASL, sasl_mechanism=GSSAPI ，並且所有內容都應該自動運行（假設Kerberos可能導致的其他999件事沒有出錯）。

Answer 2

我也無法在Windows上安裝gssapi模塊，但是我確實使用以下代碼設法使ldap3模塊針對Windows上的Active Directory進行身份驗證：

import ssl
import ldap3

tls_configuration = ldap3.Tls(validate=ssl.CERT_NONE,
                              version=ssl.PROTOCOL_TLSv1_2)
server = ldap3.Server(host='domaincontroller.example.com', port=636,
                      use_ssl=True, tls=tls_configuration,
                      get_info=ldap3.ALL)
con = ldap3.Connection(server, version=3,
                       auto_bind=True,
                       raise_exceptions=True,
                       user='EXAMPLE\\username',
                       password='MySecret',
                       authentication=ldap3.NTLM)

Answer 3

使用這個答案 ，並避免猴子補丁，我們可以使用下面的代碼，根據文件規定有並在ldap3\\core\\connection.py模塊。

ldap3kerberos.py

"""Replaces the use of python-gssapi with kerberos in ldap3.
"""

from __future__ import absolute_import
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

import base64
import socket

import ldap3
from ldap3.core.exceptions import LDAPCommunicationError
from ldap3.protocol.sasl.sasl import send_sasl_negotiation
from ldap3.protocol.sasl.sasl import abort_sasl_negotiation

from ldap3.protocol.sasl.external import sasl_external
from ldap3.protocol.sasl.digestMd5 import sasl_digest_md5
from ldap3.protocol.sasl.plain import sasl_plain
from ldap3.utils.log import log, log_enabled, BASIC
from ldap3 import EXTERNAL, DIGEST_MD5, GSSAPI


import winkerberos as kerberos

NO_SECURITY_LAYER = 1
INTEGRITY_PROTECTION = 2
CONFIDENTIALITY_PROTECTION = 4


class Connection(ldap3.Connection):

    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)

    def do_sasl_bind(self,
                     controls):
        if log_enabled(BASIC):
            log(BASIC, 'start SASL BIND operation via <%s>', self)
        self.last_error = None
        with self.connection_lock:
            result = None

            if not self.sasl_in_progress:
                self.sasl_in_progress = True
                try:
                    if self.sasl_mechanism == EXTERNAL:
                        result = sasl_external(self, controls)
                    elif self.sasl_mechanism == DIGEST_MD5:
                        result = sasl_digest_md5(self, controls)
                    elif self.sasl_mechanism == GSSAPI:
                        result = sasl_gssapi(self, controls)
                    elif self.sasl_mechanism == 'PLAIN':
                        result = sasl_plain(self, controls)
                finally:
                    self.sasl_in_progress = False

            if log_enabled(BASIC):
                log(BASIC, 'done SASL BIND operation, result <%s>', result)

            return result


def sasl_gssapi(connection, controls):
    """
    Performs a bind using the Kerberos v5 ("GSSAPI") SASL mechanism
    from RFC 4752. Does not support any security layers, only authentication!
    sasl_credentials can be empty or a tuple with one or two elements.
    The first element determines which service principal to request a ticket
    for and can be one of the following:
    - None or False, to use the hostname from the Server object
    - True to perform a reverse DNS lookup to retrieve the canonical hostname
      for the hosts IP address
    - A string containing the hostname
    The optional second element is what authorization ID to request.
    - If omitted or None, the authentication ID is used as the authorization ID
    - If a string, the authorization ID to use. Should start with "dn:" or
      "user:".
    """
    # pylint: disable=too-many-branches
    target_name = None
    authz_id = b''
    if connection.sasl_credentials:
        if (len(connection.sasl_credentials) >= 1 and
                connection.sasl_credentials[0]):
            if connection.sasl_credentials[0] is True:
                hostname = \
                    socket.gethostbyaddr(connection.socket.getpeername()[0])[0]
                target_name = 'ldap@' + hostname

            else:
                target_name = 'ldap@' + connection.sasl_credentials[0]
        if (len(connection.sasl_credentials) >= 2 and
                connection.sasl_credentials[1]):
            authz_id = connection.sasl_credentials[1].encode("utf-8")
    if target_name is None:
        target_name = 'ldap@' + connection.server.host

    gssflags = (
        kerberos.GSS_C_MUTUAL_FLAG |
        kerberos.GSS_C_SEQUENCE_FLAG |
        kerberos.GSS_C_INTEG_FLAG |
        kerberos.GSS_C_CONF_FLAG
    )

    _, ctx = kerberos.authGSSClientInit(target_name, gssflags=gssflags)

    in_token = b''
    try:
        while True:
            status = kerberos.authGSSClientStep(
                ctx,
                base64.b64encode(in_token).decode('ascii')
            )
            out_token = kerberos.authGSSClientResponse(ctx) or ''
            result = send_sasl_negotiation(
                connection,
                controls,
                base64.b64decode(out_token)
            )
            in_token = result['saslCreds'] or b''
            if status == kerberos.AUTH_GSS_COMPLETE:
                break

        kerberos.authGSSClientUnwrap(
            ctx,
            base64.b64encode(in_token).decode('ascii')
        )
        unwrapped_token = base64.b64decode(
            kerberos.authGSSClientResponse(ctx) or ''
        )

        if len(unwrapped_token) != 4:
            raise LDAPCommunicationError('Incorrect response from server')

        server_security_layers = unwrapped_token[0]
        if not isinstance(server_security_layers, int):
            server_security_layers = ord(server_security_layers)
        if server_security_layers in (0, NO_SECURITY_LAYER):
            if unwrapped_token.message[1:] != '\x00\x00\x00':
                raise LDAPCommunicationError(
                    'Server max buffer size must be 0 if no security layer'
                )
        if not server_security_layers & NO_SECURITY_LAYER:
            raise LDAPCommunicationError(
                'Server requires a security layer, but this is not implemented'
            )

        client_security_layers = bytearray([NO_SECURITY_LAYER, 0, 0, 0])
        kerberos.authGSSClientWrap(
            ctx,
            base64.b64encode(
                bytes(client_security_layers) + authz_id
            ).decode('ascii')
        )
        out_token = kerberos.authGSSClientResponse(ctx) or ''

        return send_sasl_negotiation(
            connection,
            controls,
            base64.b64decode(out_token)
        )
    except (kerberos.GSSError, LDAPCommunicationError):
        abort_sasl_negotiation(connection, controls)
        raise

安裝winkerberos ： pip install winkerberos

在腳本中，使用以下代碼（ connect_timeout ， mode和receive_timeout參數僅作為示例，可以省略或更改）：

import ldap
import ldap3kerberos

server = ldap3.Server(fqdn, connect_timeout=10, mode=ldap3.IP_V4_ONLY)
conn = ldap3kerberos.Connection(
    server, authentication=ldap3.SASL, sasl_mechanism=ldap3.GSSAPI,
    auto_bind=True, receive_timeout=10
)

如果您有一個AD域的多個域控制器服務器，請確保您要連接到某些特定的服務器，否則將出現異常：

winkerberos.GSSError: SSPI: InitializeSecurityContext: The specified target is unknown or unreachable