pykrb5

pykrb5 (installed as the krb5 package) provides Python functions that wrap the Kerberos 5 C API, exposing low-level primitives such as contexts, credentials, credential caches, and keytabs directly to Python. It targets both the MIT Kerberos and Heimdal implementations through Cython extension modules.

Because the Kerberos 5 API is complex, the maintainers recommend most applications use a higher-level GSSAPI wrapper like python-gssapi; pykrb5 is aimed at cases that need direct, fine-grained control over Kerberos credentials and caches from Python.

What You Get

• Cython-based bindings to the Kerberos 5 C API for MIT and Heimdal implementations
• Low-level access to Kerberos contexts, credentials, and credential options
• Credential cache (ccache) creation, matching, collection, and switching operations
• Keytab reading and keyblock handling
• Prebuilt wheels for common platforms, including macOS’s bundled Heimdal

Common Use Cases

• Programmatically acquiring and caching Kerberos tickets from Python
• Inspecting or manipulating credential caches and keytabs
• Building higher-level Kerberos/GSSAPI tooling on top of the raw C API
• Implementing custom Kerberos authentication flows that need direct API control

Under The Hood

Architecture The library is a collection of fine-grained Cython modules under src/krb5, one per Kerberos concept (_context, _creds, _ccache, _cccol, _kt, _keyblock, _creds_opt), each with paired .pyx implementations, .pxd declarations, and .pyi type stubs; implementation-specific variants carry _mit or _heimdal suffixes and are compiled conditionally against whichever krb5 headers are present. Tech Stack Written primarily in Cython/C wrapping the system libkrb5, packaged via setup.py/setup.cfg with build_helpers that detect the installed Kerberos flavor; requires Python 3.9+, MIT Kerberos 1.17+ or Heimdal, and ships prebuilt wheels including for macOS’s bundled Heimdal. Code Quality The repo maintains a focused pytest suite (test_ccache.py, test_creds.py, test_kt.py, test_context.py, test_changepw.py, and more) with a conftest.py, CI via GitHub Actions, complete .pyi stubs for type checking, and a maintained CHANGELOG. API Design The bindings map closely to the underlying C API, so they are precise but low-level and demanding — the README itself steers most users toward python-gssapi — giving a steep learning curve in exchange for direct, exhaustive control over Kerberos credentials and caches.