Add Kerberos Auth (#128)

[pferate]

Summary

This adds a Kerberos connection options that generates a SPNEGO ("Negotiate") token from the Kerberos credential cache for each HTTP request.

Adds use_kerberos and kerberos_hostname_override parameters to both the sync (http) and async clients, backed by a new kerberos.py module built on pyspnego/gssapi/krb5 (new kerberos extra). Because ClickHouse authenticates each HTTP request independently rather than caching auth for a session, a fresh token is generated per request rather than once at connect time.

Issue: #128

Checklist

• Unit and integration tests covering the common scenarios were added
• A human-readable description of the changes was provided to include in CHANGELOG

[joe-clickhouse]

Hi @pferate thanks for this PR as well.

Before we commit to reviewing and maintaining this long term, could you share more about the environment driving it? Kerberos is excluded from ClickHouse Cloud, so this'll be a self-managed-only feature. Some of the other client maintainers are looking at the same question so your answers could help inform that broader decision. Specifically:

1. Is this an Active Directory realm or MIT Kerberos, and what kind of environment is it?
2. Is there an org actively running kerberized ClickHouse behind this? If so roughly at what scale?
3. Is authenticating from the process credential cache sufficient for your case?
4. Are your clients Linux only or do you also need Windows via SSPI?
5. Is there a load balancer or proxy between clients and ClickHouse in your setup?

If you're more comfortable answering these outside of a public channel, let me know.

[pferate]

Hi @joe-clickhouse Personally, I don't have a dog in this race, so I can't give you any useful answers to those questions.

I was just looking through open issues and seeing where I can help contribute. I saw that #128 was open and stale, so I picked it.

[joe-clickhouse]

@pferate understood! Thanks so much for the context.