# Authentication with kerberos / AD

**URL:** <https://discourse.jupyter.org/t/authentication-with-kerberos-ad/632>\
**Category:** JupyterHub\
**Created:** [March 29, 2019, 1:07pm UTC](https://discourse.jupyter.org/t/authentication-with-kerberos-ad/632 "2019-03-29T13:07:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mvcalder](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/mvcalder/32/337_2.png) [@mvcalder](https://discourse.jupyter.org/u/mvcalder)\
**Post date:** [March 29, 2019, 1:07pm UTC](https://discourse.jupyter.org/t/authentication-with-kerberos-ad/632/1 "2019-03-29T13:07:19Z")

</div>

I set up JupyterHub for our data science team. Our firm uses Active Directory for authentication and I wanted to leverage that. I was unable to get the Kerberos authentication method that is linked from the JupyterHub github page to work. However, I was able to cobble together something that works for me so I thought I’d share it.

The basic idea is to run `kinit user@AD.DOMAIN.COM` and pipe in the password during the `authenticate` call of my custom `Authenticator` class, saving the resulting credential class file to a volume that is shared between the hub container and the spawned containers.

Two prerequisites are needed. First the hub container needs to install the packages, and possess the `krb5.config` necessary to run `kinit`. Second, the resulting kerberos credential cache file needs to be stored in a place accessible to the spawned user container, for that I used a shared volume.

With that background, the following code is my custom `Authenticator` which I defined inline in the `jupyterhub_config.py` file:

```auto
class KDBAuthenticator(Authenticator):

    @gen.coroutine
    def authenticate(self, handler, data):

        user = data.get('username', 'None').lower()
        self.log.info('Authenticating: ' + user)
        pwrd = data['password']

        realm = 'OUR.REALM.COM'
        kinit = '/usr/bin/kinit'
        krbcc = '/srv/jupyterlab/krb5cc_%s' % (user,) # This path is on the shared volume
        kuser = '%s@%s' % (user, realm)

        kinit_args = [kinit, kuser, '-c', krbcc]
        pecho_args = ['echo', '-n', pwrd]
        self.log.info('Running: ' + ' '.join(kinit_args))

        pecho = Popen(pecho_args, stdout=PIPE)
        kinit = Popen(kinit_args, stdin=pecho.stdout, stdout=PIPE, stderr=PIPE)
        
        self.log.info(kinit.communicate())
        ans = None
        if os.path.isfile(krbcc):
            os.chmod(krbcc, 0o666)        
            ans = user
        return ans       

```

There are security implications of deploying this that you may or may not be comfortable with.

I hope this helps someone else trying to do the same. If anyone has questions or comments feel free to reach out.

Matt

---

<div class="post-metadata">

**Author:** ![lresende](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/lresende/32/239_2.png) [@lresende](https://discourse.jupyter.org/u/lresende)\
**Post date:** [March 29, 2019, 6:50pm UTC](https://discourse.jupyter.org/t/authentication-with-kerberos-ad/632/2 "2019-03-29T18:50:19Z")

</div>

Cool and thanks for sharing the information. This might be an interesting scenario for us to incorporate with JupyerHub and Jupyter Enterprise Gateway integration.

@kevin-bates

---

<div class="post-metadata">

**Author:** ![Hassan\_Karimi](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/hassan_karimi/32/854_2.png) [@Hassan\_Karimi](https://discourse.jupyter.org/u/Hassan_Karimi)\
**Post date:** [July 1, 2019, 11:13am UTC](https://discourse.jupyter.org/t/authentication-with-kerberos-ad/632/3 "2019-07-01T11:13:21Z")

</div>

Can not work for me. I install jupyterhub with conda. Can you help me?

---

<div class="post-metadata">

**Author:** ![Kim\_Henriksen](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/kim_henriksen/32/5699_2.png) [@Kim\_Henriksen](https://discourse.jupyter.org/u/Kim_Henriksen)\
**Post date:** [November 15, 2021, 11:09am UTC](https://discourse.jupyter.org/t/authentication-with-kerberos-ad/632/4 "2021-11-15T11:09:59Z")

</div>

From a security perspective I don’t think anybody should implement this solution - it is not wise to send password (or any other secret) to other programs like that.

The password will be leaked in the process list (ps) which is bad.