{"id":9861,"library":"k5test","title":"Kerberos 5 Test Environment (k5test)","description":"k5test is a Python library designed for testing applications that interact with Kerberos 5. It allows for the creation of self-contained, temporary Kerberos environments, including a KDC (Key Distribution Center) and Kadmin server, simplifying integration and unit testing. The current version is 0.10.4, and it maintains an active release cadence with regular updates.","status":"active","version":"0.10.4","language":"en","source_language":"en","source_url":"https://github.com/pythongssapi/k5test","tags":["kerberos","testing","security","gssapi","kdc"],"install":[{"cmd":"pip install k5test","lang":"bash","label":"Install stable version"}],"dependencies":[],"imports":[{"symbol":"K5Context","correct":"from k5test import K5Context"}],"quickstart":{"code":"import subprocess\nfrom k5test import K5Context\nimport os\n\ndef run_k5test_example():\n    # K5Context creates a temporary Kerberos environment.\n    # It provides paths to a credential cache (ccache) and keytab,\n    # and sets up a krb5.conf to point to its KDC.\n    try:\n        with K5Context() as c:\n            print(f\"Kerberos context created. KDC Port: {c.kdc_port}\")\n            print(f\"Credential Cache: {c.ccache}\")\n            print(f\"Keytab: {c.keytab}\")\n\n            # Example: Authenticate as 'testuser' using the generated ccache\n            # kinit requires the KRB5CCNAME environment variable to be set.\n            kinit_env = os.environ.copy()\n            kinit_env['KRB5CCNAME'] = c.ccache\n            # k5test often manages KRB5_CONFIG and other Kerberos env vars internally\n            # within the context manager, or provides an 'env' dict for subprocesses.\n            # For kinit, we usually only need to override KRB5CCNAME.\n\n            print(\"\\nRunning kinit...\")\n            subprocess.run(['kinit', 'testuser'], env=kinit_env, check=True, capture_output=True)\n            print(\"kinit successful for testuser.\")\n\n            # Example: List principals using kadmin.local\n            # kadmin.local might need more environment variables set by K5Context\n            # to locate its configuration and daemons. Use c.env.\n            print(\"\\nListing principals via kadmin.local...\")\n            kadmin_output = subprocess.check_output(['kadmin.local', '-q', 'list_principals'], env=c.env, text=True)\n            print(kadmin_output)\n\n            # Your test code that uses Kerberos can go here\n            print(\"\\nKerberos environment is ready for testing.\")\n\n    except FileNotFoundError as e:\n        print(f\"Error: Kerberos binary not found. Please ensure krb5-kdc and krb5-admin-server are installed. {e}\")\n    except subprocess.CalledProcessError as e:\n        print(f\"Error during Kerberos command execution: {e}\")\n        print(f\"Stderr: {e.stderr.decode()}\")\n    except Exception as e:\n        print(f\"An unexpected error occurred: {e}\")\n\nif __name__ == \"__main__\":\n    run_k5test_example()","lang":"python","description":"This quickstart demonstrates how to set up a temporary Kerberos 5 environment using `k5test.K5Context`. It initializes a KDC, provides a credential cache and keytab, and configures `krb5.conf`. The example then uses `subprocess` to run `kinit` to authenticate 'testuser' and `kadmin.local` to list principals, showcasing how to interact with the managed Kerberos services within your tests. Note that system Kerberos binaries must be installed."},"warnings":[{"fix":"Install the appropriate Kerberos packages for your operating system (e.g., `sudo apt install krb5-kdc krb5-admin-server krb5-user` on Debian/Ubuntu or `sudo dnf install krb5-server krb5-workstation` on RHEL/Fedora).","message":"k5test relies on external Kerberos binaries. It does not provide the Kerberos 5 KDC or client executables itself. Users must have the necessary Kerberos server and client packages (e.g., `krb5-kdc`, `krb5-admin-server`, `krb5-user`) installed on their system for k5test to function.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Upgrade to k5test v0.10.2 or newer, which uses `shutil.which()` for more robust executable discovery. If upgrading is not an option, ensure `which(1)` is installed and Kerberos binaries are in standard PATH locations.","message":"Prior to v0.10.2, k5test relied on the system's `which(1)` command for locating Kerberos binaries. If `which` was not installed or if binaries like `kadmin.local` were in non-standard paths, k5test might fail to find them.","severity":"gotcha","affected_versions":"< 0.10.2"},{"fix":"If Heimdal Kerberos support is desired, explicitly specify `kdc_type='heimdal'` when creating the context: `K5Context(kdc_type='heimdal')`. The default is `kdc_type='mit'`.","message":"Version 0.10.0 introduced support for Heimdal Kerberos, which was not available in earlier versions. While the default remains MIT Kerberos, users who explicitly require Heimdal or are migrating from systems where Heimdal was implicitly used might need to update their K5Context instantiation.","severity":"breaking","affected_versions":"< 0.10.0"}],"env_vars":null,"last_verified":"2026-04-17T00:00:00.000Z","next_check":"2026-07-16T00:00:00.000Z","problems":[{"fix":"Install the necessary Kerberos client and server packages for your operating system (e.g., `krb5-kdc`, `krb5-admin-server` on Debian/Ubuntu; `krb5-server`, `krb5-workstation` on RHEL/CentOS).","cause":"k5test could not find a required Kerberos executable (e.g., `kadmin.local`, `kinit`, `krb5kdc`) on the system's PATH. This typically means the Kerberos utilities are not installed.","error":"FileNotFoundError: [Errno 2] No such file or directory: 'kadmin.local'"},{"fix":"Ensure `k5test` is installed (`pip install k5test`) and use the correct import statement: `from k5test import K5Context`.","cause":"The `K5Context` class was not found during import. This usually indicates a typo in the import statement or that the `k5test` package is not correctly installed.","error":"ImportError: cannot import name 'K5Context' from 'k5test'"},{"fix":"Review the stderr output of the `CalledProcessError` for more specific Kerberos error messages. Ensure that no system-wide Kerberos environment variables (e.g., `KRB5_CONFIG`, `KRB5CCNAME`) are unintentionally interfering with the temporary environment set up by `K5Context`. Try setting `KRB5_TRACE=/dev/stderr` in the subprocess environment to get more verbose Kerberos debugging output.","cause":"A Kerberos command executed by k5test (or by your test code via subprocess) failed. This could be due to incorrect environment variables, permissions, or conflicts with existing Kerberos configurations.","error":"subprocess.CalledProcessError: Command '['kinit', 'testuser']' returned non-zero exit status 1."}]}