Authentication

sppyte.auth

NTLM / Negotiate (Kerberos) authentication for requests, built on pyspnego.

SpPremAuth is a requests.auth.AuthBase that performs the challenge / response handshake SharePoint on-premises uses. The handshake authenticates a TCP connection, not a request, so it runs on one keep-alive connection and every later request on that connection is already authenticated; requests' connection pooling makes this transparent.

Example

from sppyte.auth import SpPremAuth

auth = SpPremAuth("jsmith", "secret", domain="CONTOSO")  # NTLM
auth = SpPremAuth(protocol="negotiate")  # Kerberos SSO

Protocol module-attribute

Protocol = Literal['ntlm', 'negotiate', 'kerberos']

Authentication protocol: ntlm, negotiate (SPNEGO, prefers Kerberos) or kerberos.

SpPremAuth

SpPremAuth(username: str | None = None, password: str | None = None, *, domain: str | None = None, protocol: Protocol = 'ntlm', service: str = 'HTTP', send_cbt: bool = True)

Bases: AuthBase

requests authentication handler for NTLM and Negotiate (Kerberos).

Parameters:

Name	Type	Description	Default
username	str | None	Account name, with or without the domain ("jsmith", "CONTOSO\jsmith" or "jsmith@contoso.local"). Omit with protocol="negotiate" or "kerberos" to use the current user's Kerberos ticket (single sign-on).	None
password	str | None	Password for username; omit for single sign-on.	None
domain	str | None	NTLM (NetBIOS) domain, prepended to a bare username.	None
protocol	Protocol	"ntlm" (default), "negotiate" (SPNEGO: Kerberos when a ticket is available, NTLM otherwise) or "kerberos".	'ntlm'
service	str	Service part of the Kerberos SPN; "HTTP" for SharePoint.	'HTTP'
send_cbt	bool	Send TLS channel bindings (tls-server-end-point) over HTTPS, which servers with Extended Protection require. On by default; harmless otherwise.	True

handle_response

handle_response(response: Response, **kwargs: Any) -> Response

Complete the handshake when the server challenges with 401 or 407.

certificate_hash

certificate_hash(certificate_der: bytes) -> bytes

Hash a DER certificate per RFC 5929 (its signature hash, or SHA-256 for MD5/SHA-1).