Skip to main content
atoti.KerberosConfig(
    *,
    username_case_conversion: ‘upper’ | ‘lower’ | None = None,
    service_principal: str,
    keytab: Path | None = None,
    krb5_config: Path | None = None,
)
The config to delegate authentication to Kerberos. The user’s roles can be defined using atoti.security.Security.kerberos and individual_roles.
Changed in version 6.2.1: The Kerberos domain name is dropped from the username: the principals alex@EXAMPLE.COM and alex are the same user, named alex.

​
Attributes

​
service_principal

The principal that the session will use.

​
keytab

The path to the keytab file to use.

​
username_case_conversion

The case conversion applied to the username of a user when they authenticate through this provider. This provider is generally case insensitive: A user named Alex can log in as "alex", "Alex", or "ALEX". individual_roles and other username-keyed mappings are case sensitive though, so each spelling is a different user and Alex is denied their roles unless they log in with the exact spelling these roles are registered under. A conversion collapses all the spellings into one: with session.security.individual_roles == {"alex": {"ROLE_USER"}}, set username_case_conversion to "lower".
Added in version 6.2.1: None keeps the username’s case unchanged.

​
krb5_config

The path to the Kerberos config file. Defaults to the OS-specific default location.