The gssapi package is a Golang wrapper around RFC 2743, the Generic Security Services Application Programming Interface. (GSSAPI)
We use it to authenticate clients with our authentication server. Clients talk to a Kerberos or Active Directory Domain Controller to retrieve a Kerberos service ticket, which we verify with a keytab on our authentication server.
When a user logs into Kerberos using
kinit, they get a Kerberos TGT. During
Kerberos authentication, that TGT is used to retrieve a Service Ticket from the
Domain Controller. GSSAPI lets us authenticate without having to know where or
in what form the TGT is stored. Because each operating system vendor might
move that, this package wraps your system GSSAPI implementation.
What do you use it for? Let us know!
This library is
go get compatible. However, it also requires header files
to build against the GSSAPI C library on your platform.
Golang needs to be able to find a gcc compiler (and one which is recent enough
to support gccgo). If the system compiler isn't gcc, then use
CC in environ
to point the Golang build tools at your gcc. (LLVM's clang does not work and
Golang's diagnostics if it encounters clang are to spew a lot of
apparently-unrelated errors from trying to use it anyway).
On MacOS, the default headers are too old; you can use newer headers for building but still use the normal system libraries.
export CC=gcc48; go install
brew install homebrew/dupes/heimdal --without-x11
- Ubuntu: see
Tests in the main
gssapi repository can be run using the built-in
To run an integrated test against a live Heimdal Kerberos Domain Controller,
cd test and bring up Docker, (or
boot2docker). Then, run
./run-heimdal.sh. This will
run some go tests using three Docker images: a client, a service, and a domain
controller. The service will receive a generated keytab file, and the client
will point to the domain controller for authentication.
NOTE: to run Docker tests, your
GOROOT environment variable MUST be set.
See our TODO doc on stuff you can do to help. We welcome contributions!
We've tested that we can authenticate against:
- Heimdal Kerberos
- Active Directory
We suspect we can authenticate against:
- MIT Kerberos
We definitely cannot authenticate with:
- Windows clients (because Windows uses SSPI instead of GSSAPI as the library interface)