Python kerberos delegation

General purpose:

Sending GET/POST requests to a remote service using user's service ticket (ST).

What I'd do if I had a kerberos domain user:

1. perform kinit user and enter password
2. obtained a ticket with authGSSClientResponse like below:

using pykerberos

__, krb_context = kerberos.authGSSClientInit(service_principal)

kerberos.authGSSClientStep(krb_context, "")

auth_header = "Negotiate "+ kerberos.authGSSClientResponse(krb_context)

headers = {"Authorization": auth_header}

r = requests.get("service_url", headers=headers)

print(r.status_code)

200

BUT! What I really have is a service principal and a keytab. Using both of them I can perform kinit keytab_file priciple and obtain a TGT to later get a ST.

The problem is that the above code won't work cause in this case I receive not a user's ST but a service's one for my principal. That's why the remote service will be responsing with a 500 error for all my requests. The authentication can be passed only with a user's ST.

As far as i know I need to use the kerberose delegation to obtain user's ST using my principal and a keytab.

from the shell I can call kvno keytab_file -U user -P remove_service_principal

But I can't find any suitable description or examples of how to do that using pykerberos or any other python library. Does anybody know how to perform delegation using python kerberos module?

By the way, I've already read the rfcs, examined source code of the library on github and tried requests-kerberos. I use Python 3.7.

Appriciate any help and advise!