Previously, the Python SDK did not support authentication to a RHEV-M server that was configured with Kerberos and only supported authentication with a username and a password. Now, the Python SDK supports authentication using a previously obtained Kerberos ticket that is valid for the realm of the RHEV-M server. To authenticate using a Kerberos ticket first acquire the Kerberos ticket by using the kinit command, or another mechanism, then use the "kerberos=True" option in the constructor of the API object.
The Python SDK should be able to take the credentials from the Kerberos cache and use them to authenticate against a Kerberos protected engine.
The flow will be as follow:
1. The user obtains a ticket granting ticket from the Kerberos realm, using the "kinit" command or any other tool.
2. The user uses the Python SDK, including in the constructor of the API object a parameter that indicates that Kerberos authentication is to be used:
api = ovirtsdk.api.API(
url="https://fedora.example.com/ovirt-engine/api",
kerberos=True,
...
)
3. The Python SDK takes the credentials from the Kerberos cache and uses them to authenticate to the oVirt Engine server.
Note that no user name or password will be provided to the Python SDK in this case, and that obtaining the initial TGT will not be the responsibility of the Python SDK.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://rhn.redhat.com/errata/RHEA-2016-0403.html
The Python SDK should be able to take the credentials from the Kerberos cache and use them to authenticate against a Kerberos protected engine. The flow will be as follow: 1. The user obtains a ticket granting ticket from the Kerberos realm, using the "kinit" command or any other tool. 2. The user uses the Python SDK, including in the constructor of the API object a parameter that indicates that Kerberos authentication is to be used: api = ovirtsdk.api.API( url="https://fedora.example.com/ovirt-engine/api", kerberos=True, ... ) 3. The Python SDK takes the credentials from the Kerberos cache and uses them to authenticate to the oVirt Engine server. Note that no user name or password will be provided to the Python SDK in this case, and that obtaining the initial TGT will not be the responsibility of the Python SDK.