The gssapi-wai package

[Tags:bsd3, library]

Basic WAI Middleware allows both SPNEGO and failback to Kerberos username/password authentication.

[Skip to Readme]


Dependencies base (>=4.8 && <4.10), base64-bytestring, bytestring, case-insensitive, gssapi, http-types, vault, wai, wai-extra [details]
License BSD3
Copyright Ondrej Palkovsky
Author Ondrej Palkovsky
Stability Unknown
Category Network
Home page
Source repository head: git clone
Uploaded Tue Mar 28 10:45:46 UTC 2017 by ondrap
Distributions NixOS:
Downloads 20 total (3 in the last 30 days)
0 []
Status Docs available [build log]
Last success reported on 2017-03-28 [all 1 reports]




Maintainer's Corner

For package maintainers and hackage trustees

Readme for gssapi-wai

Readme for gssapi-wai-

Build Status Hackage

GSSAPI and Kerberos bindings for Haskell

See haskell gssapi package for tutorial how to set up kerberos authentication with Windows AD.

This module is modelled after spnego-http-auth-nginx-module. If you are using it to provide auth, it should be reasonably easy to use this module instead.

The application

Generally you need to use TLS, otherwise browsers refuse to use SPNEGO authentication. The library provides wai middleware component to ease use. The username is saved to a vault.

{-# LANGUAGE OverloadedStrings #-}
module Main where
import           Data.ByteString.Lazy.Char8     (fromStrict)
import           Data.Function                  ((&))
import           Data.Maybe                     (fromMaybe)
import           Data.Monoid                    ((<>))
import qualified Data.Vault.Lazy                as V
import           Network.HTTP.Types             (status200)
import           Network.HTTP.Types.Header      (hContentType)
import           Network.Wai                    (Application, responseLBS,
import           Network.Wai.Handler.Warp       (defaultSettings, setPort)
import           Network.Wai.Handler.WarpTLS    (runTLS, tlsSettings)

import           Network.Wai.Middleware.SpnegoAuth

app :: Application
app req respond = do
    let user = fromMaybe "no-user-found?" (V.lookup spnegoAuthKey (vault req))
    respond $ responseLBS status200 [(hContentType, "text/plain")] ("Hello " <> fromStrict user)

main :: IO ()
main = do
  let port = 3000
      settings = defaultSettings & setPort port
      tsettings = tlsSettings "cert.pem" "key.pem"
      authSettings = defaultSpnegoSettings{spnegoRealm=Just "EXAMPLE.COM"}
  putStrLn $ "Listening on port " ++ show port
  runTLS tsettings settings (spnegoAuth authSettings app)