Kerberos support

[raubvogel@…]

Are you planning on supporting Kerberos for authenticating the server itself? Or perhaps using httpauth_user and httpauth_password to send, well, the username and password for the user to kerberos (since mod_auth_kerb will accept them instead of just tickets)?

[Álvaro Iradier]

In the Wikiprint options page in Admin you can set a username and password to use in httpauth_user and httpauth_password. Does it work for you or is there anything else needed in order to make it work?

[raubvogel@…]

AFAIK, one of my problems is that I am accessing trac using mod_alt_kerb, which does not seem to failover nicely to another auth system like basic auth (it will but then it will not accept tickets). So I was thinking on just having everyone use kerberos and be over with it.

To test that, I am editing wikiprint.py to something like this (if it works then it is easy to edit/expand the if statement to handle kerberos in addition to simple auth):

            #Allow wikiprint to authenticate using user and password, Basic HTTP Auth or Digest
            if self.env.config.get('wikiprint', 'httpauth_user'):
                # pwmgr = urllib2.HTTPPasswordMgrWithDefaultRealm()
                pwmgr = urllib2.HTTPPasswordMgr()
                # pwmgr.add_password(None, url,
                pwmgr.add_password('DOMAIN.COM', url,
                    self.env.config.get('wikiprint', 'httpauth_user'),
                    self.env.config.get('wikiprint', 'httpauth_password'))
                auth_handler = urllib2.HTTPBasicAuthHandler(pwmgr)
                auth_handler2 = urllib2.HTTPDigestAuthHandler(pwmgr)

                opener = urllib2.build_opener(auth_handler, auth_handler2)
                urllib2.install_opener(opener)

But I (probably) also need to add the urllib_kerberos stuff before testing.

[raubvogel@…]

Just to let you know, so far I have not been able to have tracwikiprint to authenticate against kerberos with an unchanged wikiprint.py and using only httpauth_user and httpauth_password. This is why I am trying other avenues.

[Álvaro Iradier]

Related to #8622