Add kerberos authentification support in libpepper.py

[arthurzenika]

requires requests_kerberos (related to #34)

Here is a pull request to start discussion on how to implement this in pepper.

There is documentation missing obviously, I'll add that once we agree on how to do this.

I think a much cleaner way to do this would be to convert all def req( to use requests and then the "optionnal" keberos authentication would be much more lightweight and I think def req would be cleaner.

[whiteinge]

This is a clean addition. I decidedly don't want pepper to dep on the requests lib for normal use but this is a good opt-in addition.

That said, if we go with option 2 from our discussion in saltstack/salt#24793 we won't need any changes at all in Salt-core or in pepper -- it'll all be contained within a regular Salt auth module.

[arthurzenika]

@whiteinge I'm not sure I understand your point about option 2 and not needing any changes in pepper. In the kerberos scenario, we don't want to send a password over the wire.

[whiteinge]

Option 2 from the discussion in that ticket:

You log in to a Kerberos server externally to Salt in order to get a Kerberos token.
You send that token to the salt-api /login URL as normal, which then checks it with > the Kerberos server and generates a Salt "session" token.
That Salt token is used on subsequent requests to Salt.

Only the Kerberos token goes over the wire to get a Salt session token. No password is sent through Salt. Fully compatible with existing Salt semantics for external auth modules, no changes to Salt, salt-api, or pepper needed.

[whiteinge]

@arthurlogilab where do you want to take this pull req in light of saltstack/salt#25122 ?

[arthurzenika]

@whiteinge this pull req is still necessary for the use case exposed. The communication with the frontal needs to authenticate with kerberos, it's the communication between the frontal and salt-api that uses the shared secret.

[whiteinge]

Roger that.

Merged and cut a new release with the addition: https://github.com/saltstack/pepper/releases/tag/0.3.6.