Skip to content

Commit f049290

Browse files
spbsolublespbsoluble
committed
feat(krb5): Add support for Kerberos (krb5) authentication.
1 parent 5e4eaa4 commit f049290

File tree

8 files changed

+1141
-57
lines changed

8 files changed

+1141
-57
lines changed

‎README.md‎

Lines changed: 193 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,14 +39,30 @@ Currently `Basic Authentication` via `Active Directory` is the *ONLY* supported
3939
| KEYFACTOR_AUTH_ACCESS_TOKEN | Access token to use to authenticate to Keyfactor Command API. This can be supplied directly or generated via client credentials | |
4040
| KEYFACTOR_AUTH_CA_CERT | Either a file path or PEM encoded string to a CA certificate to use when connecting to Keyfactor Auth | |
4141

42+
### Kerberos/SPNEGO Authentication
43+
44+
Kerberos authentication supports three methods: credential cache (ccache), keytab file, or username/password. The authentication method is determined automatically based on which credentials are provided, with the following priority: ccache > keytab > password.
45+
46+
| Name | Description | Default |
47+
|-----------------------------------|----------------------------------------------------------------------------------------------------|-------------------|
48+
| KEYFACTOR_AUTH_KRB_USERNAME | Kerberos principal (username or user@REALM format) | |
49+
| KEYFACTOR_AUTH_KRB_PASSWORD | Password for password-based Kerberos authentication | |
50+
| KEYFACTOR_AUTH_KRB_REALM | Kerberos realm (uppercase, e.g., EXAMPLE.COM). Can be implied from username if using user@REALM | |
51+
| KEYFACTOR_AUTH_KRB_KEYTAB | Path to keytab file for keytab-based authentication | |
52+
| KEYFACTOR_AUTH_KRB_CONFIG | Path to krb5.conf file | `/etc/krb5.conf` |
53+
| KEYFACTOR_AUTH_KRB_CCACHE | Path to credential cache file for ccache-based authentication | |
54+
| KEYFACTOR_AUTH_KRB_SPN | Service Principal Name (optional, auto-generated as HTTP/hostname if not specified) | |
55+
| KEYFACTOR_AUTH_KRB_DISABLE_PAFXFAST | Set to `true` to disable PA-FX-FAST for Active Directory compatibility | `false` |
56+
4257
### Test Environment Variables
4358

4459
These environment variables are used to run go tests. They are not used in the actual client library.
4560

46-
| Name | Description | Default |
47-
|------------------------|-------------------------------------------------------|---------|
48-
| TEST_KEYFACTOR_AD_AUTH | Set to `true` to test Active Directory authentication | false |
49-
| TEST_KEYFACTOR_KC_AUTH | Set to `true` to test Keycloak authentication | false |
61+
| Name | Description | Default |
62+
|-------------------------|-------------------------------------------------------|---------|
63+
| TEST_KEYFACTOR_AD_AUTH | Set to `true` to test Active Directory authentication | false |
64+
| TEST_KEYFACTOR_KC_AUTH | Set to `true` to test Keycloak authentication | false |
65+
| TEST_KEYFACTOR_KRB_AUTH | Set to `true` to test Kerberos authentication | false |
5066

5167
## Configuration File
5268

@@ -153,6 +169,55 @@ servers:
153169
api_path: KeyfactorAPI
154170
```
155171
172+
### Kerberos/SPNEGO
173+
174+
#### JSON (with keytab)
175+
176+
```json
177+
{
178+
"servers": {
179+
"default": {
180+
"host": "keyfactor.command.kfdelivery.com",
181+
"username": "svc_keyfactor",
182+
"kerberos_realm": "EXAMPLE.COM",
183+
"kerberos_keytab": "/etc/keytabs/svc_keyfactor.keytab",
184+
"kerberos_config": "/etc/krb5.conf",
185+
"api_path": "KeyfactorAPI"
186+
}
187+
}
188+
}
189+
```
190+
191+
#### JSON (with password)
192+
193+
```json
194+
{
195+
"servers": {
196+
"default": {
197+
"host": "keyfactor.command.kfdelivery.com",
198+
"username": "user@EXAMPLE.COM",
199+
"password": "password",
200+
"kerberos_realm": "EXAMPLE.COM",
201+
"kerberos_config": "/etc/krb5.conf",
202+
"api_path": "KeyfactorAPI"
203+
}
204+
}
205+
}
206+
```
207+
208+
#### YAML (with keytab)
209+
210+
```yaml
211+
servers:
212+
default:
213+
host: keyfactor.command.kfdelivery.com
214+
username: svc_keyfactor
215+
kerberos_realm: EXAMPLE.COM
216+
kerberos_keytab: /etc/keytabs/svc_keyfactor.keytab
217+
kerberos_config: /etc/krb5.conf
218+
api_path: KeyfactorAPI
219+
```
220+
156221
## Configuration File Providers
157222
158223
Below are a list of configuration file providers that can be used to load configuration from a file if loading from disk
@@ -205,4 +270,128 @@ servers:
205270
parameters:
206271
secret_name: <akv_secret_name>
207272
vault_name: <akv_vault_name>
273+
```
274+
275+
# Testing
276+
277+
To run the tests you'll need to provide a `${HOME}/.keyfactor/command_config.json` file for some of the tests to use.
278+
279+
## Example:
280+
281+
```json
282+
{
283+
"servers": {
284+
"default": {
285+
"host": "<insert keyfactor command hostname>",
286+
"port": 443,
287+
"client_id": "<insert valid client_id>",
288+
"client_secret": "<insert valid client_secret>",
289+
"token_url": "https://<insert oauth2 token endpoint hostname>/oauth2/token",
290+
"api_path": "Keyfactor/API",
291+
"auth_provider": {},
292+
"skip_tls_verify": true,
293+
"auth_type": "oauth"
294+
},
295+
"basic-auth": {
296+
"host": "<insert valid keyfactor command hostname>",
297+
"port": 443,
298+
"username": "<insert valid keyfactor command username>",
299+
"password": "<insert valid keyfactor command password>",
300+
"domain": "<insert valid AD domain name>",
301+
"api_path": "KeyfactorAPI",
302+
"auth_provider": {},
303+
"skip_tls_verify": true,
304+
"auth_type": "basic"
305+
},
306+
"default": {
307+
"host": "<insert valid keyfactor command hostname>",
308+
"port": 443,
309+
"username": "<insert valid keyfactor command username>",
310+
"password": "<insert valid keyfactor command password>",
311+
"domain": "<insert valid AD domain name>",
312+
"api_path": "KeyfactorAPI",
313+
"auth_provider": {},
314+
"skip_tls_verify": true,
315+
"auth_type": "basic"
316+
},
317+
"invalid-host": {
318+
"host": "<insert valid keyfactor command hostname>",
319+
"port": 443,
320+
"username": "<insert valid keyfactor command username>",
321+
"password": "<insert valid keyfactor command password>",
322+
"domain": "<insert valid AD domain name>",
323+
"api_path": "KeyfactorAPI",
324+
"auth_provider": {},
325+
"skip_tls_verify": true,
326+
"auth_type": "basic"
327+
},
328+
"invalid-username": {
329+
"host": "<insert valid keyfactor command hostname>",
330+
"port": 443,
331+
"username": "invalid",
332+
"password": "<insert valid keyfactor command password>",
333+
"domain": "<insert valid AD domain name>",
334+
"api_path": "KeyfactorAPI",
335+
"auth_provider": {},
336+
"skip_tls_verify": true,
337+
"auth_type": "basic"
338+
},
339+
"invalid-password": {
340+
"host": "<insert valid keyfactor command hostname>",
341+
"port": 443,
342+
"username": "<insert valid keyfactor command username>",
343+
"password": "invalid",
344+
"domain": "<insert valid AD domain name>",
345+
"api_path": "KeyfactorAPI",
346+
"auth_provider": {},
347+
"skip_tls_verify": true,
348+
"auth_type": "basic"
349+
},
350+
"oauth": {
351+
"host": "<insert keyfactor command hostname>",
352+
"port": 443,
353+
"client_id": "<insert valid client_id>",
354+
"client_secret": "<insert valid client_secret>",
355+
"token_url": "https://<insert oauth2 token endpoint hostname>/oauth2/token",
356+
"api_path": "Keyfactor/API",
357+
"auth_provider": {},
358+
"skip_tls_verify": true,
359+
"auth_type": "oauth"
360+
},
361+
"oauth-invalid-creds": {
362+
"host": "<insert keyfactor command hostname>",
363+
"port": 443,
364+
"client_id": "invalid",
365+
"client_secret": "invalid",
366+
"token_url": "https://<insert oauth2 token endpoint hostname>/oauth2/token",
367+
"api_path": "Keyfactor/API",
368+
"auth_provider": {},
369+
"skip_tls_verify": true,
370+
"auth_type": "oauth"
371+
},
372+
"oauth-invalid-host": {
373+
"host": "invalid.localhost.dev",
374+
"port": 443,
375+
"client_id": "<insert valid client_id>",
376+
"client_secret": "<insert valid client_secret>",
377+
"token_url": "https://<insert oauth2 token endpoint hostname>/oauth2/token",
378+
"api_path": "Keyfactor/API",
379+
"auth_provider": {},
380+
"skip_tls_verify": true,
381+
"auth_type": "oauth"
382+
},
383+
"oauth-skiptls": {
384+
"host": "<insert keyfactor command hostname>",
385+
"port": 443,
386+
"client_id": "<insert valid client_id>",
387+
"client_secret": "<insert valid client_secret>",
388+
"token_url": "https://<insert oauth2 token endpoint hostname>/oauth2/token",
389+
"api_path": "Keyfactor/API",
390+
"auth_provider": {},
391+
"skip_tls_verify": true,
392+
"auth_type": "oauth"
393+
}
394+
}
395+
}
396+
208397
```

‎auth_providers/auth_basic_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -209,12 +209,12 @@ func TestCommandAuthConfigBasic_Authenticate(t *testing.T) {
209209

210210
t.Log("Testing Basic Auth with invalid creds implicit config file")
211211
invProfileCreds := &auth_providers.CommandAuthConfigBasic{}
212-
invProfileCreds.WithConfigProfile("invalid_username")
212+
invProfileCreds.WithConfigProfile("invalid-username")
213213
authBasicTest(t, "with invalid creds implicit config file", true, invProfileCreds, invalidCredsExpectedError...)
214214

215215
t.Log("Testing Basic Auth with invalid Command host implicit config file")
216216
invHostConfig := &auth_providers.CommandAuthConfigBasic{}
217-
invHostConfig.WithConfigProfile("invalid_host")
217+
invHostConfig.WithConfigProfile("invalid-host")
218218
invHostExpectedError := []string{"no such host"}
219219
authBasicTest(
220220
t, "with invalid Command host implicit config file", true, invHostConfig,

0 commit comments

Comments
 (0)