AlonSoko opened a new pull request, #195: URL: https://github.com/apache/phoenix-queryserver/pull/195
### Problem On Windows, phoenixdb requires MIT Kerberos for Windows (KfW), even though Windows has Kerberos built in (LSA/SSPI): - `requests-gssapi` (which pulls in `gssapi`) is an unconditional install requirement. - `phoenixdb/__init__.py` imports `gssapi` and `requests_gssapi` at module level, so `import phoenixdb` fails without a working GSSAPI library, even for BASIC/DIGEST/no authentication. ### Changes - `phoenixdb/__init__.py`: the `gssapi` / `requests_gssapi` imports move into `_get_SPNEGOAuth()`, which only runs for `authentication='SPNEGO'`. On `win32` it returns the new SSPI auth class; elsewhere (or if `pyspnego` is not available) it builds `HTTPSPNEGOAuth(opportunistic_auth=True, mech=SPNEGO)` exactly as before. - `phoenixdb/sspi_auth.py` (new): `HTTPSPNEGOAuthSSPI`, a small `requests` auth class on top of [pyspnego](https://github.com/jborean93/pyspnego), which uses native SSPI on Windows and so the logged-on user's tickets (no KfW, no `kinit`). It mirrors the current behaviour: an opportunistic `Negotiate` token for `HTTP/<host>`, mutual auth disabled. A 401 carrying a server token is answered once on the same connection (multi-leg, e.g. NTLM fallback); a 401 without one is returned as is. - It uses `protocol="negotiate"` (the SPNEGO mechanism), keeping the mechanism choice from PHOENIX-6414 / PHOENIX-6781. `requests-kerberos` was not used because it hard-codes the raw Kerberos mechanism. - A `gssapi` package installed without KfW raises `OSError` on import, and pyspnego only catches `ImportError` around its optional gssapi import (reported as jborean93/pyspnego#117), so `import spnego` fails. That case now raises a `RuntimeError` naming the cause and the fix (`pip uninstall gssapi requests-gssapi`). - `setup.py`, `requirements.txt`: platform markers; `requests-gssapi` on non-Windows, `pyspnego` on Windows (Python >= 3.8). Python < 3.8 is unchanged. Linux/macOS behaviour and the public API (`connect(..., authentication='SPNEGO')`, `user` as `doAs`) are unchanged. ### Testing - Windows 11 (domain-joined, no KfW, no `kinit`), Python 3.12 x64, against a Kerberized Phoenix Query Server: `SELECT 1` and table queries succeed with `authentication='SPNEGO'`; `klist` shows the `HTTP/<fqdn>` service ticket obtained through SSPI. - Multi-leg path: loopback test with a real SSPI acceptor (`spnego.server`), NTLM fallback: 401 + challenge, then 200 on the same connection; a 401 without a token is returned after a single request. - macOS: `import phoenixdb` works without `gssapi` installed; the existing unit tests that do not need a live Query Server pass. I don't have an ASF JIRA account yet, so there is no PHOENIX ticket for this. I'm happy to file one, or for a committer to create it, and retitle the PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
