GSS-TSIG Authentication Support for Active Directory DNS about octodns-bind

[ross]

The code currently has support for straight tsig auth:

octodns-bind/octodns_bind/__init__.py

Lines 195 to 203 in a6fb996

	def _auth_params(self):
	params = {}
	if self.key_name is not None:
	params['keyring'] = tsigkeyring.from_text(
	{self.key_name: self.key_secret}
	)
	if self.key_algorithm is not None:
	params['keyalgorithm'] = self.key_algorithm
	return params

Not familiar with gss-tsig, but I assume it can be added. PRs welcome.

[mayeter]

Well, I don't exactly know what happens behind the scene, either. I know that GSS-TSIG involves kerberos and sssd clients. You gotta authenticate and get your kerberos ticket (TGT) first. Then, for example, its enough to specifg -g flag for nsupdate tool. So we gotta get ticket from kerberos firstly (like using klist).

I might be wrong about specific details, I am not an expert on the subject, either, but I am open to collobrate on the subject if anyone else is willing to 🙂

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment or this will be closed in 7 days.