vault-plugin-auth-kerberos

KO | EN

gitlite — search

#javascript #hacktoberfest #ai #golang #machine-learning #linux #nodejs #awesome #cli #kubernetes #security #mcp #openai #open-source

vault-plugin-auth-kerberos

(★ 35)

[DEPRECATED] Plugin for Hashicorp Vault enabling Kerberos authentication

vault-plugin-auth-kerberos 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# [DEPRECATED] Vault Plugin: Kerberos Auth Backend

> :warning: **This repo is no longer maintained**: [It has been taken over by Hashicorp as an official plugin which you can find here](https://github.com/hashicorp/vault-plugin-auth-kerberos)

This is a standalone backend plugin for use with [Hashicorp Vault](https://www.github.com/hashicorp/vault).
This plugin allows for users to authenticate with Vault via Kerberos/SPNEGO.

You can find binaries on the [Release page](https://github.com/wintoncode/vault-plugin-auth-kerberos/releases).

## Usage

### Authentication

You can authenticate by posting a valid SPNEGO Negotiate header to `/v1/auth/kerberos/login`.

```python
try:
    import kerberos
except:
    import winkerberos as kerberos
import requests

service = "HTTP/vault.domain"
rc, vc = kerberos.authGSSClientInit(service=service, mech_oid=kerberos.GSS_MECH_OID_SPNEGO)
kerberos.authGSSClientStep(vc, "")
kerberos_token = kerberos.authGSSClientResponse(vc)

r = requests.post("https://vault.domain:8200/v1/auth/kerberos/login",
                  json={'authorization': 'Negotiate ' + kerberos_token})
print('Vault token:', r.json()['auth']['client_token'])
```

### Configuration

1. Install and register the plugin.

Put the plugin binary (`vault-plugin-auth-kerberos`) into a location of your choice. This directory
will be specified as the [`plugin_directory`](https://www.vaultproject.io/docs/configuration/index.html#plugin_directory)
in the Vault config used to start the server.

```json
...
plugin_directory = "path/to/plugin/directory"
...
```

```sh
$ vault write sys/plugins/catalog/auth/kerberos sha_256="$(shasum -a 256 'vault-plugin-auth-kerberos' | cut -d ' ' -f1)" command="vault-plugin-auth-kerberos -client-cert server.crt -client-key server.key"
```

2. Enable the Kerberos auth method:

```sh
$ vault auth enable -passthrough-request-headers=Authorization -allowed-response-headers=www-authenticate kerberos
Success! Enabled kerberos auth method at: kerberos/
```

3. Use the /config endpoint to configure Kerberos.

Create a keytab for the kerberos plugin:
```sh
$ ktutil
ktutil:  addent -password -p your_service_account@REALM.COM -e aes256-cts -k 1
Password for your_service_account@REALM.COM:
ktutil:  list -e
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    1            your_service_account@REALM.COM (aes256-cts-hmac-sha1-96)
ktutil:  wkt vault.keytab
```

The KVNO (`-k 1`) should match the KVNO of the service account. An error will show in the vault logs if this is incorrect.

Different encryption types can also be added to the keytab, for example `-e rc4-hmac` with additional `addent` commands.

Then base64 encode it:
```sh
base64 vault.keytab > vault.keytab.base64
```

```sh
vault write auth/kerberos/config keytab=@vault.keytab.base64 service_account="your_service_account"
```

4. Add a SPNs (Service Principal Names) to your KDC for your service and service account. This should map the vault service to the account it is running as:
```sh
# for Windows/Active Directory
setspn.exe -U -S HTTP/vault.domain:8200 your_service_account
setspn.exe -U -S HTTP/vault.domain your_service_account
```

5. Configure LDAP backend to look up Vault policies.
Configuration for LDAP is identical to the [LDAP](https://www.vaultproject.io/docs/auth/ldap.html)
auth method, but writing to to the Kerberos endpoint:

```sh
vault write auth/kerberos/config/ldap @vault-config/auth/ldap/config
vault write auth/kerberos/groups/example-role @vault-config/auth/ldap/groups/example-role
```

In non-kerberos mode, the LDAP bind and lookup works via the user that is currently trying to authenticate.
If you're running LDAP together with Kerberos you might want to set a binddn/bindpass in the ldap config.

## Developing

If you wish to work on this plugin, you'll first need
[Go](https://www.golang.org) installed on your machine.

For local dev first make sure Go is properly installed, including
setting up a [GOPATH](https://golang.org/doc/code.html#GOPATH).
Next, clone this repository into
`$GOPATH/src/github.com/wintoncode/vault-plugin-auth-kerberos`.
You can then download any required build tools by bootstrapping your
environment:

```sh
$ make bootstrap
```

To compile a development version of this plugin, run `make` or `make dev`.
This will put the plugin binary in the `bin` and `$GOPATH/bin` folders. `dev`
mode will only generate the binary for your platform and is faster:

```sh
$ make
$ make dev
```

Put the plugin binary into a location of your choice. This directory
will be specified as the [`plugin_directory`](https://www.vaultproject.io/docs/configuration/index.html#plugin_directory)
in the Vault config used to start the server.

```json
...
plugin_directory = "path/to/plugin/directory"
...
```

Start a Vault server with this config file:
```sh
$ vault server -config=path/to/config.json ...
...
```

Once the server is started, register the plugin in the Vault server's [plugin catalog](https://www.vaultproject.io/docs/internals/plugins.html#plugin-catalog):

```sh
$ vault write sys/plugins/catalog/kerberos \
        sha_256=<expected SHA256 Hex value of the plugin binary> \
        command="vault-plugin-auth-kerberos"
...
Success! Data written to: sys/plugins/catalog/kerberos
```

Note you should generate a new sha256 checksum if you have made changes
to the plugin. Example using openssl:

```sh
openssl dgst -sha256 $GOPATH/vault-plugin-auth-kerberos
...
SHA256(.../go/bin/vault-plugin-auth-kerberos)= 896c13c0f5305daed381952a128322e02bc28a57d0c862a78cbc2ea66e8c6fa1
```

Enable the auth plugin backend using the Kerberos auth plugin:

```sh
$ vault auth-enable -plugin-name='kerberos' plugin
...

Successfully enabled 'plugin' at 'kerberos'!
```

#### Tests

If you are developing this plugin and want to verify it is still
functioning (and you haven't broken anything else), we recommend
running the tests.

To run the tests, invoke `make test`:

```sh
$ make test
```

You can also specify a `TESTARGS` variable to filter tests like so:

```sh
$ make test TESTARGS='--run=TestConfig'
```

vault-plugin-auth-kerberos

vault-plugin-auth-kerberos 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

vault-plugin-auth-kerberos

vault-plugin-auth-kerberos 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README