minikerberos

0.4.9 verified Fri May 01 auth: no python

Pure Python library for Kerberos manipulation, including AS-REQ, TGS-REQ, Kerberoasting, ASREP roasting, and cross-domain authentication. Version 0.4.9 supports Python >=3.6 and is actively maintained on GitHub by skelsec. Release cadence is irregular, with security fixes and feature additions.

pip install minikerberos

Common errors

error ModuleNotFoundError: No module named 'minikerberos' ↓

cause Library not installed or installed in wrong environment.

fix

Run 'pip install minikerberos' in the correct Python environment.

error 'KerberosClient' object has no attribute 'get_TGT' ↓

cause Using old synchronous client API. In 0.4.x, the method is 'get_TGT()' on async client, but synchronous client uses a different method.

fix

Use 'AIOKerberosClient' with async/await, or check minikerberos.client for sync methods (e.g., 'KerberosClient().tgt' attribute after login).

error ValueError: Only unicode objects are acceptable for encoding ↓

cause Passing bytes instead of string for text fields (e.g., username, password).

fix

Ensure all string parameters are Python str, not bytes. Use .decode() if necessary.

error oscrypto.errors.LibraryNotFoundError: No crypto library found ↓

cause oscrypto not installed but required for PKI operations (e.g., using certificates).

fix

pip install oscrypto

Warnings

breaking API changed significantly between versions 0.3.x and 0.4.x. The old synchronous client (minikerberos.client) was replaced with both sync and async versions. Many function signatures changed. ↓

fix Review the examples at https://github.com/skelsec/minikerberos/tree/master/examples for updated usage.

gotcha The 'oscrypto' library is optional but required for PKI-based auth. Installation does not prompt; you must install it manually (pip install oscrypto) if using certificates. ↓

fix pip install oscrypto

deprecated The top-level imports like 'from minikerberos import KerberosClient' are deprecated. Correct import paths use submodules. ↓

fix Use 'from minikerberos.client import KerberosClient' or 'from minikerberos.aioclient import AIOKerberosClient'.

Imports

AIOKerberosClient

from minikerberos.aioclient import AIOKerberosClient

Main asynchronous client class

KerberosClient

from minikerberos.client import KerberosClient

Synchronous client class

getKerberosTGT

from minikerberos.common import getKerberosTGT

Utility to obtain TGT

Quickstart

Basic example: authenticate and obtain a TGT using the asynchronous client.

from minikerberos.aioclient import AIOKerberosClient
from minikerberos.common import getKerberosTGT
import asyncio

async def example():
    username = 'administrator'
    domain = 'example.local'
    password = 'password123!'
    # Use environment variable for sensitive data (replace with actual auth if needed)
    # username = os.environ.get('KRB_USER', 'administrator')
    # password = os.environ.get('KRB_PASS', '')
    # domain = os.environ.get('KRB_DOMAIN', 'example.local')
    client = AIOKerberosClient(domain, username, password)
    tgt = await client.get_TGT()
    print('TGT obtained successfully')

asyncio.run(example())