Module krb5 

Python bindings for Kerberos V5 and PKINIT types from synta_krb5.

This module builds the synta.krb5 Python submodule, exposing the Kerberos V5 and PKINIT ASN.1 types needed for certificate construction and for parsing Kerberos AS exchanges.

Contents

Principal-name support

• PyKrb5PrincipalName — the RFC 4556 KRB5PrincipalName OtherName value embedded in PKINIT certificates.
• KRB5_PRINCIPAL_NAME_OID — ObjectIdentifier for id-pkinit-san (1.3.6.1.5.2.2, RFC 4556 §3.2.2).
• NT_* integer constants — principal name types from RFC 4120 §6.2.

PKINIT protocol types (RFC 4556 + RFC 6112 + RFC 8636)

Provided by crate::pkinit::register_pkinit_classes:

Python class	RFC / section	Description
EncryptionKey	RFC 3961 §2	Algorithm type and raw key material
Checksum	RFC 3961 §4	Algorithm type and raw checksum bytes
KDFAlgorithmId	RFC 8636 §3.1	KDF OID used in the PKINIT exchange
IssuerAndSerialNumber	RFC 4556 §3.2.2	Certificate identified by issuer + serial
ExternalPrincipalIdentifier	RFC 4556 §3.2.2	Certificate by name, issuer/serial, or SKI
PKAuthenticator	RFC 4556 §3.2.1	Client proof of liveness in AS-REQ
AuthPack	RFC 4556 §3.2.1	Signed client authentication package
PaPkAsReq	RFC 4556 §3.2.2	PKINIT pre-authentication request
DHRepInfo	RFC 4556 §3.2.4	KDC Diffie-Hellman reply data
KDCDHKeyInfo	RFC 4556 §3.2.4	KDC DH public key and nonce
ReplyKeyPack	RFC 4556 §3.2.3	Session key and checksum from KDC
PaPkAsRep	RFC 4556 §3.2.4	PKINIT pre-authentication reply (CHOICE)

Principal name types (NT_*)

Constant	Value	RFC / source	Typical use
NT_UNKNOWN	0	RFC 4120 §6.2	Unknown / unspecified
NT_PRINCIPAL	1	RFC 4120 §6.2	User or host principal
NT_SRV_INST	2	RFC 4120 §6.2	Service + instance (e.g. krbtgt)
NT_SRV_HST	3	RFC 4120 §6.2	Service + hostname
NT_SRV_XHST	4	RFC 4120 §6.2	Service + host (remaining components)
NT_UID	5	RFC 4120 §6.2	Unique ID
NT_X500_PRINCIPAL	6	RFC 4120 §6.2	Encoded X.500 DN
NT_SMTP_NAME	7	RFC 4120 §6.2	SMTP email address
NT_ENTERPRISE	10	RFC 6806 §5	Enterprise principal (UPN-like)
NT_WELLKNOWN	11	RFC 8062 §3	Well-known principal (anonymous)
NT_SRV_HST_DOMAIN	12	MS-SFU §2.1	Host-based service (Windows)

Register

Call register_krb5_module from the extension crate’s #[pymodule]:

krb5::register_krb5_module(m)?;

Structs

PyKrb5PrincipalName

RFC 4556 KRB5PrincipalName — Kerberos principal embedded in a PKINIT certificate as an OtherName Subject Alternative Name.

Functions

register_krb5_module

Build and register the synta.krb5 submodule into parent.