requests-kerberos

requests-kerberos is an authentication handler that adds optional Kerberos/GSSAPI support to the popular Python Requests HTTP library. By passing an HTTPKerberosAuth instance as the auth argument, any Requests call can negotiate SPNEGO-based Kerberos authentication against a server, including mutual authentication.

The library plugs into the standard Requests authentication interface, so the entire requests.api is supported. It relies on the system Kerberos C libraries and a GSSAPI backend to perform the underlying negotiation.

What You Get

• HTTPKerberosAuth handler that drops into any Requests call via the auth parameter
• Automatic SPNEGO negotiation handling of the WWW-Authenticate challenge/response flow
• Configurable mutual authentication (REQUIRED, OPTIONAL, or DISABLED)
• Support for delegation, custom principals, and hostname override options
• Full compatibility with the standard requests.api surface

Common Use Cases

• Authenticating to Kerberos-protected intranet web services from Python
• Calling SPNEGO-secured REST APIs behind Active Directory or MIT Kerberos
• Enforcing mutual authentication when talking to internal enterprise endpoints
• Scripting automated access to Kerberized HTTP resources

Under The Hood

Architecture The package is compact — requests_kerberos/kerberos_.py holds the HTTPKerberosAuth class that subclasses Requests’ AuthBase, hooks the response via a response handler to catch 401s, generates the SPNEGO Negotiate token through the GSSAPI backend, retries the request with the Authorization header, and optionally verifies the server’s return token for mutual authentication; exceptions.py defines the error types. Tech Stack Pure Python built on the requests library and a GSSAPI binding (pyspnego/gssapi) over the system Kerberos C libraries, packaged via pyproject.toml with separate runtime and test requirement files. Code Quality The repo ships both unit (test_requests_kerberos.py) and functional (test_functional_kerberos.py) test suites plus CI via GitHub Actions, a maintained HISTORY.rst, and a long contributor list, reflecting a mature and well-tested codebase despite low recent activity. API Design The API is intentionally minimal and idiomatic: you construct one HTTPKerberosAuth object (with a few keyword options like mutual_authentication and delegate) and hand it to Requests’ standard auth= parameter, so existing Requests users need to learn almost nothing new.