Possibly switch to requests-gssapi

[opoplawski]

While requesting pykrb5 to be packaged for Fedora, Andreas Schneider suggested that requests_ntlm should migrate to requests-gssapi:

You can even use requests-gssapi. There is a simple function HTTPSPNEGOAuth(). Maybe ask upstream if they could migrate.

See https://bugzilla.redhat.com/show_bug.cgi?id=2099857#c5

I however know nothing of how any of this works - just passing it along.

[jborean93]

The landscape is super muddy here and it doesn't help that there are various terms and acronyms being used. I would highly recommend people use requests-gssapi but not because of the underlying libraries being used but rather to avoid NTLM altogether. NTLM is an ancient protocol that is insecure and just bad. The modern replacement is Kerberos but unfortunately there are some scenarios where Kerberos cannot be used so people are still somewhat stuck with NTLM.

You can use requests-gssapi and I probably would recommend people do so in order for Kerberos to be used but that doesn't remove the need for this library. For people needing to NTLM this provides a pure Python implementation without any need of system libraries and to compile Python extensions which can be painful in some environments. If they wanted to use NTLM anyway the requests-gssapi library is still a possible option but using NTLM through GSSAPI is problematic for a few reasons:

• Not all distros have gssntlmssp
• It's only available for MIT krb5 and not Heimdal
• It relies on ciphers like MD4, RC4, that OpenSSL may not allow you to use based on system policies

This library also has no dependency on pykrb5, it relies on pyspnego but not the Kerberos extras so there is really no bearing there.