{"id":2090,"library":"krb5","title":"PyKerberos (krb5)","description":"krb5 is a Python library that provides direct bindings to the MIT Kerberos 5 C API, enabling Python applications to interact with Kerberos for authentication and security services at a low level. The current version is 0.9.0, with regular releases (typically a few times a year) maintaining compatibility and extending its API coverage.","status":"active","version":"0.9.0","language":"en","source_language":"en","source_url":"https://github.com/jborean93/pykrb5","tags":["kerberos","authentication","security","bindings","krb5"],"install":[{"cmd":"pip install krb5","lang":"bash","label":"Install krb5"}],"dependencies":[{"reason":"Required as a build dependency for compiling the C extensions.","package":"Cython","optional":false},{"reason":"Requires the system's Kerberos 5 C API implementation and its header files (e.g., libkrb5-dev on Debian/Ubuntu, krb5-devel on RHEL/CentOS) and a C compiler.","package":"MIT Kerberos 5 development libraries","optional":false}],"imports":[{"note":"The primary module containing functions that mirror the C API (with the 'krb5_' prefix removed).","symbol":"krb5","correct":"import krb5"},{"note":"The custom exception class raised for Kerberos API errors.","symbol":"Krb5Error","correct":"from krb5.exceptions import Krb5Error"}],"quickstart":{"code":"import krb5\nfrom krb5.exceptions import Krb5Error\nimport os\n\ntry:\n    # Initialize a Kerberos context\n    ctx = krb5.init_context()\n    print(\"Kerberos context initialized successfully.\")\n\n    # Example: Parse a principal name\n    # Replace 'testuser@EXAMPLE.COM' with a valid principal in your Kerberos environment\n    # or set KRB5_PRINCIPAL environment variable for example.\n    principal_name = os.environ.get('KRB5_PRINCIPAL', 'host/localhost@REALM.TEST')\n    \n    # Using with statement ensures proper cleanup of the context and principal\n    with ctx:\n        with krb5.parse_name(ctx, principal_name) as principal:\n            print(f\"Parsed principal: {principal.name}\")\n            print(f\"Principal Realm: {principal.realm}\")\n\nexcept Krb5Error as e:\n    print(f\"Kerberos Error: {e.message} (Code: {e.error_code})\")\n    print(\"Ensure Kerberos is configured correctly and system libraries are installed.\")\nexcept Exception as e:\n    print(f\"An unexpected error occurred: {e}\")","lang":"python","description":"This example demonstrates how to initialize a Kerberos context and parse a principal name using the krb5 library. It includes basic error handling for `Krb5Error` which wraps the underlying Kerberos C API errors. It's crucial to have system Kerberos development libraries installed for this to build and run successfully."},"warnings":[{"fix":"Ensure your Python environment meets the minimum version requirement for the krb5 library you intend to use. Upgrade Python if necessary.","message":"Python version support is frequently updated. Version 0.9.0 requires Python 3.9+ (dropped 3.8 in v0.8.0). Prior versions 0.7.0 and 0.4.0 also dropped support for Python 3.7 and 3.6, respectively.","severity":"breaking","affected_versions":">=0.4.0"},{"fix":"Ensure Cython is installed in your build environment (`pip install Cython`) before installing krb5 from source. When using pip, this should be handled automatically by PEP 517 build isolation.","message":"Since version 0.4.0, Cython is a mandatory build dependency. The source distribution (sdist) no longer includes the pre-compiled `.c` files, requiring Cython to be available during installation.","severity":"breaking","affected_versions":">=0.4.0"},{"fix":"Evaluate whether your use case requires direct C API interaction or if a higher-level library like `python-gssapi` would better suit your needs for Kerberos authentication workflows.","message":"This library provides low-level bindings to the Kerberos C API. For higher-level, more Pythonic interactions with Kerberos (especially involving GSSAPI), `python-gssapi` is often a more suitable and recommended library.","severity":"gotcha","affected_versions":"All"},{"fix":"If using krb5 in a free-threading environment, be aware of potential thread safety issues and test thoroughly. Consider external synchronization if multiple threads interact with the library concurrently.","message":"While v0.9.0 adds support for Python Free-Threading (PEP 779), the library has limited testing in this scenario and 'does not aim to be thread safe out of the box'.","severity":"gotcha","affected_versions":">=0.9.0"}],"env_vars":null,"last_verified":"2026-04-09T00:00:00.000Z","next_check":"2026-07-08T00:00:00.000Z"}