Add Windows native authentication support

[gentoo90]

Add kerberos-sspi as an alternative backend.
kerberos-sspi package is an API level equivalent with kerberos
package but uses windows sspi (through pywin32)

[sigmavirus24]

Before merging this, we need to review if anything here is necessary for this to be a real alternative backend.

[gentoo90]

The methods:

• changePassword
• getServerPrincipalDetails

not used by requests-kerberos.

The flags:

• GSS_C_ANON_FLAG
• GSS_C_PROT_READY_FLAG
• GSS_C_TRANS_FLAG

requests-kerberos uses default value of gssflags parameter of authGSSClientInit method.

Any way this seems to be the only kerberos implementation on Windows.
And this commit changes nothing for other platforms.

[sigmavirus24]

It seems there is a bug fix in master that has yet to be released (in kerberos-sspi). I would expect anyone who runs headlong into it to complain upstream. I'm +1 on this as I suspect it's useful. I'll defer to @Lukasa and @mkomitee

[mkomitee]

This is a great idea:

1. Will this apply cleanly against pull request Brought rrig's implementation of kerberos delegation up to date with master #32? It optionally modifies the gssflags to support delegation.
2. With kerberos a requirement on the package the import should always succeed. How would kerberos_sspi ever be imported?

[sigmavirus24]

@mkomitee

1. looks like it will apply cleanly.
2. Good question, I suspect someone will pip uninstall kerberos && pip install kerberos-sspi if they know they need it.

[mkomitee]

That's kind of ugly -- Users are expected to install requests_kerberos, which will attempt to (and maybe fail to) install kerberos. Then they're expected to uninstall kerberos and install kerberos-sspi?

Is there a way w/ setuptools to mark two packages as alternatives, and allow either one to fulfill the dependency?

If not, should we remove our dependency on kerberos and update the code to try kerberos, then try kerberos-sspi, then raise a custom exception that instructs them to install one of them?

btw, i'm +1 on merging this as is if it helps people, but we should come up with a better way to handle the kerberos/kerberos-sspi dependency.

[gentoo90]

Fixed if statement as @sigmavirus24 said. Commit amended

[tardyp]

👍 This PR fixes my windows kerberos authentication issues in a clean fashion. Please merge it!

[e-nouri]

👍 Kerberos SSPI fixed the issue on Windows, pealse merge it!

[mkomitee]

If it's not already clear from before, I'm +1.

[sigmavirus24]

@gentoo90 can you rebase this? It isn't mergeable in its present state

[gentoo90]

Done. Sorry for the delay.

[carsonyl]

@sigmavirus24 I'm in favour of this, and the changes look good to me. Right now I'm accomplishing the same result by renaming kerberos_sspi.py to kerberos.py.

[sigmavirus24]

Thanks for the 👀 @rbcarson