Django gssapi/kerberos SPNEGO auth view

views.py

import base64
import gssapi

from django.http import HttpResponse

FQDN = socket.getfqdn()
REALM = "EXAMPLE.COM"

server_name = gssapi.Name('http/%s@%s' % (FQDN, REALM))
server_creds = gssapi.Credentials(usage='accept', name=server_name)

def testauth(request):
    auth_header = request.META.get('HTTP_AUTHORIZATION', None)
    if auth_header is None or not auth_header.startswith('Negotiate '):
        print("Missing auth: '%s'" % auth_header)
        response = HttpResponse('Unauthorized', status=401)
        response['WWW-Authenticate'] = 'Negotiate '
        return response
    else:
        tok = base64.b64decode(auth_header[len('Negotiate '):])
        ctx = gssapi.SecurityContext(creds=server_creds, usage='accept')
        server_tok = ctx.step(tok)
        b64tok = base64.b64encode(server_tok)
        print('Done: %s' % ctx.complete)
        if ctx.complete:
            response = HttpResponse('Hello %s' % (ctx.initiator_name,))
        else:
            response = HttpResponse('Unauthorized', status=401)
        response['WWW-Authenticate'] = 'Negotiate ' + b64tok.decode('ascii')
        return response