The kerberos package is a C++ extension for Node.js that provides cross-platform support for kerberos authentication using GSSAPI on linux/osx, and SSPI on windows. Much of the code in this module is adapted from ccs-kerberos and winkerberos.
Linux
python v2.7makekrb5-dev on Ubuntu)macOS
Xcode Command Line Tools: Can be installed with xcode-select --installkrb5 on Homebrew)Windows
Option 1: Install all the required tools and configurations using Microsoft's windows-build-tools by running npm install -g windows-build-tools from an elevated PowerShell (run as Administrator).
Option 2: Install dependencies and configuration manually
💡 [Windows Vista / 7 only] requires .NET Framework 4.5.1
v3.x.x is not supported), and run npm config set python python2.7npm config set msvs_version 2015Only the following version combinations with the MongoDB Node.js Driver are considered stable.
kerberos@1.x kerberos@2.x mongodb@6.x N/A ✓ mongodb@5.x ✓ ✓ mongodb@4.x ✓ ✓ mongodb@3.x ✓ N/A
Now you can install kerberos with the following:
Below are the platforms that are available as prebuilds on each github release. prebuild-install downloads these automatically depending on the platform you are running npm install on.
Releases are created automatically and signed using the Node team's GPG key. This applies to the git tag as well as all release packages provided as part of a GitHub release. To verify the provided packages, download the key and import it using gpg:
gpg --import node-driver.asc
The GitHub release contains a detached signature file for the NPM package (named kerberos-X.Y.Z.tgz.sig).
The following command returns the link npm package.
npm view kerberos@vX.Y.Z dist.tarball
Using the result of the above command, a curl command can return the official npm package for the release.
To verify the integrity of the downloaded package, run the following command:
gpg --verify kerberos-X.Y.Z.tgz.sig kerberos-X.Y.Z.tgz
Note
No verification is done when using npm to install the package. To ensure release integrity when using npm, download the tarball manually from the GitHub release, verify the signature, then install the package from the downloaded tarball using npm install mongodb-X.Y.Z.tgz.
To verify the native .node packages, follow the same steps as above.
Run the test suite using:
docker run -i -v PATH_TO_KERBEROS_REPO:/app -w /app -e PROJECT_DIRECTORY=/app ubuntu:20.04 /bin/bash /app/.evergreen/run-tests-ubuntu.sh
NOTE: The test suite requires an active kerberos deployment.
Promise
This function provides a simple way to verify that a user name and password match those normally used for Kerberos authentication. It does this by checking that the supplied user name and password can be used to get a ticket for the supplied service. If the user name does not contain a realm, then the default realm supplied is used.
For this to work properly the Kerberos must be configured properly on this machine. That will likely mean ensuring that the edu.mit.Kerberos preference file has the correct realms and KDCs listed.
IMPORTANT: This method is vulnerable to KDC spoofing attacks and it should only be used for testing. Do not use this in any production system - your security could be compromised if you do.
Promise
This function returns the service principal for the server given a service type and hostname.
Details are looked up via the /etc/keytab file.
Promise
Initializes a context for client-side authentication with the given service principal.
Promise
Initializes a context for server-side authentication with the given service principal.
Properties
Name Type Description usernamestring The username used for authentication response string The last response received during authentication steps responseConf string Indicates whether confidentiality was applied or not (GSSAPI only) contextComplete boolean Indicates that authentication has successfully completed or not
string A string containing the base64-encoded server data (which may be empty for the first step) [callback] function
Processes a single kerberos client-side step using the supplied server challenge.
Returns: Promise - returns Promise if no callback passed
string The response returned after calling unwrap [options] object Optional settings [options.user] string The user to authorize [options.protect] boolean Indicates if the wrap should request message confidentiality [callback] function
Perform the client side kerberos wrap step.
Returns: Promise - returns Promise if no callback passed
string A string containing the base64-encoded server data [callback] function
Perform the client side kerberos unwrap step
Returns: Promise - returns Promise if no callback passed
Properties
Name Type Description usernamestring The username used for authentication response string The last response received during authentication steps targetName string The target used for authentication contextComplete boolean Indicates that authentication has successfully completed or not kerberosServer.step(challenge, [callback]) Param Type Description challenge string A string containing the base64-encoded client data [callback] function
Processes a single kerberos server-side step using the supplied client data.
Returns: Promise - returns Promise if no callback passed
string The Kerberos user name. If no realm is supplied, then the defaultRealm will be used. password string The password for the user. service string The Kerberos service to check access for. [defaultRealm] string The default realm to use if one is not supplied in the user argument. [callback] function
This function provides a simple way to verify that a user name and password match those normally used for Kerberos authentication. It does this by checking that the supplied user name and password can be used to get a ticket for the supplied service. If the user name does not contain a realm, then the default realm supplied is used.
For this to work properly the Kerberos must be configured properly on this machine. That will likely mean ensuring that the edu.mit.Kerberos preference file has the correct realms and KDCs listed.
IMPORTANT: This method is vulnerable to KDC spoofing attacks and it should only be used for testing. Do not use this in any production system - your security could be compromised if you do.
Returns: Promise - returns Promise if no callback passed
string The Kerberos service type for the server. hostname string The hostname of the server. [callback] function
This function returns the service principal for the server given a service type and hostname.
Details are looked up via the /etc/keytab file.
Returns: Promise - returns Promise if no callback passed
string A string containing the service principal in the form 'type@fqdn' (e.g. 'imap@mail.apple.com'). [options] object Optional settings [options.principal] string Optional string containing the client principal in the form 'user@realm' (e.g. 'jdoe@example.com'). [options.flags] number Optional integer used to set GSS flags. (e.g. GSS_C_DELEG_FLAG|GSS_C_MUTUAL_FLAG|GSS_C_SEQUENCE_FLAG will allow for forwarding credentials to the remote host) [options.mechOID] number Optional GSS mech OID. Defaults to None (GSS_C_NO_OID). Other possible values are GSS_MECH_OID_KRB5, GSS_MECH_OID_SPNEGO. [callback] function
Initializes a context for client-side authentication with the given service principal.
Returns: Promise - returns Promise if no callback passed
string A string containing the service principal in the form 'type@fqdn' (e.g. 'imap@mail.apple.com'). [callback] function
Initializes a context for server-side authentication with the given service principal.
Returns: Promise - returns Promise if no callback passed
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4