spnego

README

go-spnego

The package extends Go's HTTP Transport allowing Kerberos authentication through Negotiate mechanism (see RFC4559).

Internally it is implemented by wrapping 2 libraries: gokrb5 on Linux and sspi on Windows.

There is no pre-authenticaion yet, so the library assumes you have Kerberos ticket obtained.

Linux implementation requires MIT or Heimdal Kerberos to be present. Windows implementation utilizes credentials of currently logged in user.

Currently it allows only to make HTTP calls, no server side support yet.

Installation

go get github.com/dpotapov/go-spnego

Usage example

import "github.com/dpotapov/go-spnego"
...
c := &http.Client{
    Transport: &spnego.Transport{},
}

resp, err := c.Get("http://kerberized.service.com/")

Configuration

Windows: no configuration options.

Linux:

• KRB5_CONFIG - path to configuration file in MIT Kerberos format. Default is /etc/krb5.conf.
• KRB5CCNAME - path to credential cache in the form type:residual. Only FILE: type is supported. Default is FILE:/tmp/krb5cc_$(id -u)

Documentation

Index

• type Error
  • func (e *Error) Error() string
• type Provider
  • func New() Provider
• type Transport
  • func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error)

Types

type Error

type Error struct {
	Err error
}

Error is used to distinguish errors from underlying libraries (gokrb5 or sspi).

func (*Error) Error

func (e *Error) Error() string

Error implements the error interface

type Provider

type Provider interface {
	SetSPNEGOHeader(*http.Request, bool) error
}

Provider is the interface that wraps OS agnostic functions for handling SPNEGO communication

func New

func New() Provider

New constructs OS specific implementation of spnego.Provider interface

type Transport

type Transport struct {
	http.Transport

	NoCanonicalize bool
	// contains filtered or unexported fields
}

Transport extends the native http.Transport to provide SPNEGO communication

func (*Transport) RoundTrip

func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error)

RoundTrip implements the RoundTripper interface.