Kerberos Provider
Relevant source files
The following files were used as context for generating this wiki page:
The Kerberos Provider in the FLEXT Auth system provides enterprise-grade authentication capabilities by leveraging the Kerberos protocol for Single Sign-On (SSO) and ticket-based identity verification. It is integrated into the project as a specialized authentication provider, identified by the kerberos provider type, and is designed to handle service tickets and principal-based authentication within a Kerberos realm.
Sources: src/flext_auth/providers/kerberos.py:1-15, src/flext_auth/history.json:L120
Architecture and Components
The Kerberos implementation follows a SOLID-compliant architecture, delegating specific responsibilities to specialized internal classes and support helpers. The primary implementation, FlextAuthKerberosProvider, inherits from both FlextAuthKerberosSupport and FlextAuthRfcProvider.
Component Diagram
The following diagram illustrates the relationship between the provider, its support mixin, and the specialized internal managers.
The provider uses composition for ticket validation, service ticket handling, and authentication management to maintain a clean separation of concerns.
Sources: src/flext_auth/providers/kerberos.py:13-30, src/flext_auth/providers/kerberos_support.py:12-85
Configuration and Validation
The Kerberos provider requires a specific configuration mapping to function. Validation is performed using a railway-oriented approach to ensure all required enterprise fields are present and correctly typed.
Required Fields
| Field | Type | Description |
|---|---|---|
realm | str | The Kerberos realm (e.g., EXAMPLE.COM). |
kdc | str | The Key Distribution Center address. |
service_principal | str | The principal name of the service. |
Sources: src/flext_auth/providers/kerberos_support.py:17-21
Optional Fields
| Field | Type | Description |
|---|---|---|
keytab_path | str | Path to the service keytab file. |
clockskew_tolerance | int | Allowed time difference in seconds. |
ticket_lifetime | int | Duration for which a ticket is valid. |
renew_lifetime | int | Maximum renewal duration for tickets. |
forwardable | bool | Whether tickets can be forwarded. |
proxiable | bool | Whether tickets can be proxied. |
Sources: src/flext_auth/providers/kerberos_support.py:25-33
Authentication Flow
The authentication process centers on validating a Kerberos token (ticket) and resolving it into a FlextAuth identity. The provider supports two primary paths: a configured ticket_validator callback or a JWT-bridge fallback.
Token Validation Sequence
The following diagram shows the logic flow when validate_token is invoked with a Kerberos ticket.
If a ticket_validator is provided in the configuration, it is used to process the token. The validator can return a full AuthIdentity, a KerberosTicketData object (which is then mapped to a default user role), or a raw Mapping that is validated against the identity model.
Sources: src/flext_auth/providers/kerberos.py:46-95, src/flext_auth/providers/kerberos_support.py:88-112
Capabilities and Metadata
The Kerberos provider identifies itself within the flext-auth ecosystem through specific metadata and capability flags. These flags allow the system to determine when to route enterprise SSO requests to this provider.
Provider Metadata
- Name:
kerberos - Version:
5 - Capabilities:
{"kerberos", "sso", "enterprise", "ticket", "validate"}
Sources: src/flext_auth/providers/kerberos.py:32-44
Related Constants
The system defines the Kerberos provider type in the central constants registry:
class ProviderTypes(StrEnum):
# ...
KERBEROS = "kerberos"
Sources: src/flext_auth/history.json:L120
Implementation Details
Initialization
During initialization, the provider performs a scalar projection of settings and immediately runs a configuration validation. If required fields like realm or kdc are missing, it raises a ValueError to prevent invalid provider states.
Sources: src/flext_auth/providers/kerberos.py:21-30
Error Handling
The provider implements "fail-loud" and "loud-validation" patterns:
- Missing configuration returns a failure
p.Result. - Improperly typed configuration fields return descriptive error messages.
- Validator execution errors are caught and returned as operational failures.
Sources: src/flext_auth/providers/kerberos_support.py:38-54, src/flext_auth/providers/kerberos.py:73-77
Summary
The Kerberos Provider is a critical component for enterprise environments within flext-auth. It leverages a support-mixin architecture to provide ticket validation and service handling while maintaining strict adherence to the project's result-oriented and type-safe patterns. By supporting both custom validator callbacks and standard principal mapping, it offers flexibility for various Kerberos infrastructure setups.