(self, auth_header, callback)
Perform Negotiate (GSSAPI/SSO) authentication via Kerberos.
Perform Negotiate (GSSAPI/SSO) authentication via Kerberos.
Perform Negotiate ( GSSAPI / SSO ) authentication via Kerberos .
def auth_negotiate(self, auth_header, callback):
        """
        Perform Negotiate (GSSAPI/SSO) authentication via Kerberos.
        """
        auth_str = auth_header.split()[1]
        # Initialize Kerberos Context
        context = None
        try:
            result, context = kerberos.authGSSServerInit(
                self.settings['sso_service'])
            if result != 1:
                raise tornado.web.HTTPError(500, _("Kerberos Init failed"))
            result = kerberos.authGSSServerStep(context, auth_str)
            if result == 1:
                gssstring = kerberos.authGSSServerResponse(context)
            else: # Fall back to Basic auth
                self.auth_basic(auth_header, callback)
            # NOTE: The user we get from Negotiate is a full UPN (user@REALM)
            user = kerberos.authGSSServerUserName(context)
        except kerberos.GSSError as e:
            logging.error(_("Kerberos Error: %s" % e))
            raise tornado.web.HTTPError(500, _("Kerberos Init failed"))
        finally:
            if context:
                kerberos.authGSSServerClean(context)
        self.set_header('WWW-Authenticate', "Negotiate %s" % gssstring)
        callback(user)
def auth_negotiate ( self , auth_header , callback ) : auth_str = auth_header . split ( ) [ 1 ] # Initialize Kerberos Context context = None try : result , context = kerberos . authGSSServerInit ( self . settings [ 'sso_service' ] ) if result != 1 : raise tornado . web . HTTPError ( 500 , _ ( "Kerberos Init failed" ) ) result = kerberos . authGSSServerStep ( context , auth_str ) if result == 1 : gssstring = kerberos . authGSSServerResponse ( context ) else : # Fall back to Basic auth self . auth_basic ( auth_header , callback ) # NOTE: The user we get from Negotiate is a full UPN (user@REALM) user = kerberos . authGSSServerUserName ( context ) except kerberos . GSSError as e : logging . error ( _ ( "Kerberos Error: %s" % e ) ) raise tornado . web . HTTPError ( 500 , _ ( "Kerberos Init failed" ) ) finally : if context : kerberos . authGSSServerClean ( context ) self . set_header ( 'WWW-Authenticate' , "Negotiate %s" % gssstring ) callback ( user )