Registry / http-networking / requests-credssp

requests-credssp

library2.0.0pypypi✓ verified 87d ago

requests-credssp is a Python library that enables HTTPS CredSSP authentication for the popular `requests` library. CredSSP is a Microsoft authentication protocol allowing credentials to be delegated to a server for double-hop authentication. It supports CredSSP protocol versions 2 to 6, initial authentication with NTLM or Kerberos, and message encryption. The library is actively maintained, with the latest major release (v2.0.0) in February 2022.

http-networking auth-security

pip install requests-credssp

github ↗package ↗

INSTALL

IMPORT

SIG · REQUESTS-CREDSSP

requests-credssp

http-networkingpythonv2.0.0

Install

—

Import

—

Disk

—

Pass rate

0/ 10

Env Coverage0 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v2.0.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

glibc

py 3.10

4/8 runs

py 3.11

4/8 runs

py 3.12

4/8 runs

py 3.13

4/8 runs

py 3.9

4/8 runs

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

HttpCredSSPAuth

✓ from requests_credssp import HttpCredSSPAuth

This quickstart demonstrates how to use `requests-credssp` to perform an HTTP GET request with CredSSP authentication. It initializes `HttpCredSSPAuth` with a username and password (preferably from environment variables for security) and then uses it with a standard `requests.get()` call. The `minimum_version` parameter can be used to specify the required CredSSP protocol version for the server.

import requests import os from requests_credssp import HttpCredSSPAuth # It's recommended to retrieve credentials from environment variables or a secure store username = os.environ.get('CREDSSP_USERNAME', 'DOMAIN\\user') password = os.environ.get('CREDSSP_PASSWORD', 'password') # Initialize the CredSSP authentication handler # minimum_version can be set (e.g., 5) to enforce higher CredSSP protocol versions credssp_auth = HttpCredSSPAuth(username, password, minimum_version=5) # Make a request using the CredSSP authentication try: # Replace with your actual CredSSP-enabled endpoint response = requests.get("https://server:5986/wsman", auth=credssp_auth, verify=False) response.raise_for_status() print(f"Request successful: {response.status_code}") print(response.text) except requests.exceptions.RequestException as e: print(f"Request failed: {e}") if e.response is not None: print(f"Response content: {e.response.text}")

Debug

Known issues

breakingIn v2.0.0, several properties and methods on the `HttpCredSSPAuth` class (e.g., `tls_context`, `tls_connection`, `cipher_negotiated`, `wrap()`, `unwrap()`) were removed. They must now be accessed through the `auth.contexts[hostname]` dictionary attribute.

fix

Access these properties/methods via `auth.contexts[hostname].<property_or_method>` instead of directly on the `HttpCredSSPAuth` instance.

affects: >=2.0.0

breakingVersion 2.0.0 removed `pyOpenSSL` and `pyasn1` as direct dependencies, relying solely on `pyspnego` for CredSSP exchange. This change can affect TLS/SSL cipher suite negotiation, especially with older Windows servers (e.g., Windows Server 2012 R2), as `pyspnego` utilizes Python's built-in `ssl` module, which might adhere to stricter system-wide OpenSSL policies.

fix

For compatibility with older Windows servers, ensure your Python environment's OpenSSL (or the system's) is configured to support the necessary cipher suites. Upgrading server OS or using a WinRM certificate for CredSSP on the server can also resolve issues. Setting `minimum_version` in `HttpCredSSPAuth` to a lower value (if acceptable for security) might also help.

affects: >=2.0.0

breakingSupport for Python 2.7, 3.4, and 3.5 was dropped in v1.3.0. The minimum Python version required is now 3.6.

fix

Upgrade your Python environment to Python 3.6 or newer.

affects: >=1.3.0

gotchaKerberos authentication on Linux/Unix systems requires additional system-level development packages (e.g., `libkrb5-dev`, `python-dev`) and installing `requests-credssp` with the `[kerberos]` extra (`pip install requests-credssp[kerberos]`). Without these, CredSSP will likely fall back to NTLM or fail.

fix

Install the necessary system packages and the `[kerberos]` extra as documented in the installation instructions.

affects: All versions

Errors

Common errors & fixes

credssp: Server did not response with a CredSSP token after step TLS Handshake - actual 'Negotiate, Basic realm="WSMAN", CredSSP'

This error often indicates that the server returned a 401 Unauthorized response or failed to negotiate a compatible TLS/cipher suite. It can be particularly common with older Windows servers (like 2012 R2) after upgrading `requests-credssp` to v2.0.0, due to changes in how TLS is handled by `pyspnego` (which uses Python's `ssl` module directly).

fix

First, verify that the provided username and password are correct and have appropriate permissions on the target server. If credentials are correct, check the server's TLS/cipher suite compatibility. Consider updating the server's OS, ensuring it has necessary CredSSP/TLS updates, or configuring a stronger WinRM certificate. On the client, ensure your Python's `ssl` module (and underlying OpenSSL) supports ciphers compatible with the server. Debug with `logging.getLogger('requests_credssp').setLevel(logging.DEBUG)`.

An authentication error has occurred. The function requested is not supported. Remote computer: <computer name or IP>. This could be due to CredSSP encryption oracle remediation.

This message typically indicates a mismatch in CredSSP security configurations between the client and the server, specifically related to the 'Encryption Oracle Remediation' policy. It often happens when a client with CredSSP updates tries to connect to a server without them, and the client's policy is set too strictly (e.g., 'Force Updated Clients' or 'Mitigated' on the client side, disallowing insecure connections).

fix

Ensure both client and server have the latest CredSSP security updates. Alternatively, on the client machine, navigate to 'Computer Configuration > Administrative Templates > System > Credentials Delegation' in `gpedit.msc` and change the 'Encryption Oracle Remediation' policy to 'Enabled' and set the Protection Level to 'Vulnerable' (for testing, not recommended for production) or 'Mitigated' (if the server is still unpatched). The best long-term fix is to patch the server.

ImportError: cannot import name 'HttpCredSSPAuth' from 'requests_credssp'

This error means the `HttpCredSSPAuth` class is not found in the `requests_credssp` module. This is usually due to a typo in the import statement or the library not being correctly installed in the active Python environment.

fix

Verify that the import statement is `from requests_credssp import HttpCredSSPAuth`. Ensure `requests-credssp` is installed in your current Python environment by running `pip show requests-credssp` and `pip install requests-credssp` if it's missing or outdated.

Upgrade

Version history

2.0.0latest on PyPI · released Feb 21, 2022

Audit

Dependencies

cryptographyrequiredRequired for secure communication.

pyspnegorequiredCore library for CredSSP exchange, introduced in v1.2.0 and central since v2.0.0.

requests>=2.0.0requiredThe underlying HTTP library.

python-gssapioptionalOptional, for Kerberos authentication on Unix systems, installed with `[kerberos]` extra.

pykrb5optionalOptional, for Kerberos authentication on Unix systems, installed with `[kerberos]` extra.

Agent activity

9 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/jborean93/requests-credssp ↗

packagehttps://pypi.org/project/requests-credssp/ ↗