{"id":19168367,"url":"https://github.com/bloomberg/catalyst-authentication-credential-gssapi","last_synced_at":"2025-05-07T14:41:36.429Z","repository":{"id":66125140,"uuid":"46587383","full_name":"bloomberg/Catalyst-Authentication-Credential-GSSAPI","owner":"bloomberg","description":"A module that provides integration of the Catalyst web application framework with GSSAPI/SPNEGO HTTP authentication.","archived":false,"fork":false,"pushed_at":"2017-04-01T23:14:54.000Z","size":16,"stargazers_count":6,"open_issues_count":0,"forks_count":7,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-04-19T23:31:57.447Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Perl","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bloomberg.png","metadata":{"files":{"readme":"README","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2015-11-20T21:18:50.000Z","updated_at":"2022-04-23T02:32:39.000Z","dependencies_parsed_at":null,"dependency_job_id":"eaae3064-20c5-4d05-974b-41e106f346ca","html_url":"https://github.com/bloomberg/Catalyst-Authentication-Credential-GSSAPI","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bloomberg%2FCatalyst-Authentication-Credential-GSSAPI","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bloomberg%2FCatalyst-Authentication-Credential-GSSAPI/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bloomberg%2FCatalyst-Authentication-Credential-GSSAPI/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bloomberg%2FCatalyst-Authentication-Credential-GSSAPI/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bloomberg","download_url":"https://codeload.github.com/bloomberg/Catalyst-Authentication-Credential-GSSAPI/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252897385,"owners_count":21821431,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-09T09:42:24.921Z","updated_at":"2025-05-07T14:41:36.405Z","avatar_url":"https://github.com/bloomberg.png","language":"Perl","funding_links":[],"categories":[],"sub_categories":[],"readme":"NAME\n    Catalyst::Authentication::Credential::GSSAPI - rfc4559 SPNEGO/GSSAPI\n\nSYNOPSIS\n    In your application configuration:\n\n      \u003cauthentication\u003e\n        default_realm \"myrealm\"\n        \u003crealms\u003e\n          \u003cmyrealm\u003e\n            \u003ccredential\u003e\n              class \"GSSAPI\"\n            \u003c/credential\u003e\n            \u003cstore\u003e\n              class \"LDAP\"\n              ldap_server \"myrealm.mydomain.com\"\n              binddn \"anonymous\"\n              bindpw \"dontcarehow\"\n              user_basedn \"OU=Users,DC=myrealm,DC=mydomain,DC=com\"\n              user_field \"userprincipalname\"\n              user_filter \"(userprincipalname=%s)\"\n              user_scope \"sub\"\n            \u003c/store\u003e\n          \u003c/myrealm\u003e\n        \u003c/realms\u003e\n      \u003c/authentication\u003e\n\n    On your application code:\n\n      $c-\u003eauthenticate({ });\n\nDESCRIPTION\n    This module implements the HTTP negotiation described in rfc4559. The\n    authentication is implemented by the natively calling the gssapi from\n    the krb5 library. It provides only the \"Credential\" part of the system.\n    You are required to plugin a different \"Storage\", such as LDAP, in order\n    to get the data for the user info.\n\n    This allows your application to perform Single-Sign-On (SSO) if you are\n    in an environment with Kerberos authentication. One example of such\n    scenario is for environments managed with Microsoft Active Directory.\n\n    This module will not, however, perform password-based authentication on\n    the Kerberos realm. It will only accept token-based negotiation with\n    GSSAPI.\n\n    Like Catalyst::Authentication::Credential::HTTP, this module will detach\n    your action for the HTTP negotiation to happen and will only return when\n    a valid user was authenticated and retrieved from the store.\n\nKEYTABS AND PRINCIPALS\n    When implementing GSSAPI negotiation over HTTP, the convention specify\n    that the name of the principal for the service will always be:\n\n      HTTP/hostname.of.the.server\n\n    Such that if the client is connecting to\n\n      http://myservice.mydomain.com\n\n    the name of Service Principal Name (SPN) will be required to be\n\n      HTTP/myservice.mydomain.com\n\n    The SPN needs to be registered with the kerberos server, and application\n    needs to be run with a keytab that contains that principal. One way to\n    verify that is by doing:\n\n      $ k5srvutil -f mykeytabfile.keytab list\n      Keytab name: FILE:mykeytabfile.keyttab\n      KVNO Principal\n      ---- --------------------------------------------------------------------\n       3 serviceaccount@MYREALM.MYDOMAIN.COM\n       3 HTTP/myservice.mydomain.com@MYREALM.MYDOMAIN.COM\n\n    With the MIT krb5 library, you can use the keytab by exporting the\n    following environment variable for the process running the application:\n\n      export KRB5_KTNAME=FILE:/full/path/to/mykeytabfile.keytab\n\n    That way the application will be able to participate in the\n    authentication.\n\nCLIENT SIDE\n    The client side, of course, also has to support this negotiation.\n\n  BROWSER SUPPORT\n    All major browsers support this negotiation, some configuration may be\n    required in order to enable it.\n\n  CURL\n    Curl can be built with krb5 support, at which point you should be able\n    to use:\n\n      curl --negotiate -u x:x http://myservice.mydomain.com\n\n    The \"-u x:x\" argument is necessary in order to tell curl to enable\n    authentication, the user name and password will not be used and can be\n    set to a dummy value, like \"x:x\".\n\nCONFIGURATION\n    username_field\n        This configures what field should the username be set to in the\n        authinfo hash. Defaults to \"username\".\n\n        The authentication will send the \"src name\" from gssapi as the user\n        name for the find_user call.\n\n    strip_realm\n        When using kerberos, the full principal name is returned, which is\n        usually in the form of user@REALM. Setting this will strip\n        everything after the '@' before sending it to the credential store.\n        This is useful if you are using a store that is not connected to the\n        kerberos authentication.\n\nUSING WITH LDAP ON MICROSOFT ACTIVE DIRECTORY\n    Active Directory offers the LDAP attribute \"userprincipalname\" that will\n    match the kerberos principal used by this API. If you set the user_field\n    and user_filter configurations of the LDAP store, it will seamlessly\n    integrate and return you a valid LDAP user.\n\nCOPYRIGHT\n    Copyright 2015 Bloomberg Finance L.P.\n\n    Licensed under the Apache License, Version 2.0 (the \"License\"); you may\n    not use this file except in compliance with the License. You may obtain\n    a copy of the License at\n\n      http://www.apache.org/licenses/LICENSE-2.0\n\n    Unless required by applicable law or agreed to in writing, software\n    distributed under the License is distributed on an \"AS IS\" BASIS,\n    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n    See the License for the specific language governing permissions and\n    limitations under the License.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbloomberg%2Fcatalyst-authentication-credential-gssapi","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbloomberg%2Fcatalyst-authentication-credential-gssapi","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbloomberg%2Fcatalyst-authentication-credential-gssapi/lists"}