Add Kerberos authentication support

[dcl]

As of version 3.4, Zookeeper allows authentication via Kerberos, but at the moment only the Java client supports it. Are there plans to add this to Kazoo in the near future?

[buddyadmin]

Is SASL & JAAS supported with Kazoo?

[hannosch]

Currently there's no SASL/Kerberos support in kazoo - pull requests welcome :)

[mkomitee]

I've got working code based on the PyGSSAPI library (which implements a nice SASL/GSSAPI object that made it quite simple to do so). I'm seeing if I can get permission to release it.

[mkomitee]

I've ported my patch to the master branch (It was previously written against 1.3.1) and it works fine. There are a few caveats:

1. The released version of PyGSSAPI which it uses is python 2.7+ only, so this would break python 2.6 backwards compatibility. I have a very small patch for PyGSSAPI which makes it work with 2.6 (they used one dictionary expression)
2. The released version of PyGSSAPI has a bug in it which causes it to not support SASL Authentication with no negotiated security layer (which is valid) despite it looking like they explicitly tried to support it. Since in general you want a security layer involved, I can see why their tests missed it. Unfortunately ZooKeeper doesn't support SASL security layers. I have a patch to the released version of PyGSSAPI which fixes this.

The only real problem I foresee is that PyGSSAPI seems to be in the midst of a massive refactor and I'm not sure when they'll be cutting a new release that includes my fixes (and to be clear, I haven't submit them or even approached them about it yet).

It also looks like they've changed their API enough that my current patch (to kazoo) will not currently work with their dev branch.

... for the short term (and if they can't/won't cut a new release based on their currently released 1.0.0), would we be interested in vendoring PyGSSAPI?

[mkomitee]

I took a closer look through PyGSSAPI's dev branch and it looks like it's not so much an API change as it's just incomplete.

[bbangert]

Does PyGSSAPI work on Python 3? Or will it need some guard statements around it to enable it only on Python 2.6/2.7?

[romainr]

@mkomitee, do you have your current patches pushed somewhere?

We are going to have a look (we use PyKerberos, not PyGSSAPI) to see how long it would take.

[mkomitee]

I'll see if I can dig them up.

[romainr]

Thanks, right now we went up with SASL module in #284

[mkomitee]

I submit #287 to serve as a reference. I hope it helps.

[bbangert]

I'd be happy to merge a new PR for this, until there's more traction on this I'm closing this issue.