Add Kerberos and NTLM auth adapters for HTTPXWrapper by mwdd146980 · Pull Request #22706 · DataDog/integrations-core

mwdd146980 · 2026-02-20T23:41:21Z

Summary

Add KerberosAuth(httpx.Auth) using spnego for GSSAPI/Kerberos negotiate: preemptive and non-preemptive modes, mutual auth, delegate, keytab
Add NTLMAuth(httpx.Auth) using spnego for three-step NTLM handshake: Type1 Negotiate → Type2 Challenge → Type3 Authenticate
Wire both adapters into _build_httpx_client for auth_type=kerberos/ntlm
spnego loaded via lazy_loader; no startup cost when auth is not used
Add test_httpx_auth.py with 12 tests covering all auth flows using mocked spnego

Test plan

ddev test datadog_checks_base -- tests/base/utils/http/test_httpx_auth.py -v
ddev test datadog_checks_base -- tests/base/utils/http/test_http_httpx.py::TestBuildHttpxClient -v

🤖 Generated with Claude Code

datadog-datadog-prod-us1 · 2026-02-20T23:43:50Z

⚠️ Tests

✨ Fix all issues with BitsAI or with Cursor

⚠️ Warnings

🧪 6 Tests failed

test_config_httpx[legacy auth config-extra_config0-expected0] from test_unit.py (Datadog) (Fix with Cursor)
No module named 'httpx'
test_config_httpx[legacy ssl config False-extra_config3-expected3] from test_unit.py (Datadog) (Fix with Cursor)
No module named 'httpx'
test_config_httpx[legacy ssl config True-extra_config2-expected2] from test_unit.py (Datadog) (Fix with Cursor)
No module named 'httpx'
View all

ℹ️ Info

❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 8142f0b | Docs | Datadog PR Page | Was this helpful? React with 👍/👎 or give us feedback!}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5a613fa354

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-02-20T23:45:05Z

datadog_checks_base/datadog_checks/base/utils/httpx_auth.py

+        principal: str | None = None,
+        keytab: str | None = None,
+    ) -> None:
+        self._mutual_authentication = mutual_authentication.lower()


Accept boolean kerberos_auth values

KerberosAuth.__init__ unconditionally calls .lower() on mutual_authentication, but _build_httpx_client still forwards legacy kerberos_auth: true values on the deprecated compatibility path. In that case client construction raises AttributeError before any request is sent, so existing Kerberos configs that worked in the requests wrapper fail when using HTTPX.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-02-20T23:45:05Z

datadog_checks_base/datadog_checks/base/utils/httpx_auth.py

+            ctx = self._build_context(hostname)
+            token = ctx.step(in_token=server_token)


Reuse Kerberos context across preemptive 401 retry

When force_preemptive is enabled, the flow sends an initial token with one context and then creates a brand-new context on a 401 before processing the server challenge. SPNEGO/Kerberos handshakes are stateful, so the challenge token should be handled by the same context that generated the first token; resetting it can cause preemptive Kerberos auth to fail on servers that respond with a challenge.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-02-20T23:45:05Z

datadog_checks_base/datadog_checks/base/utils/httpx_auth.py

+            if server_token:
+                try:
+                    ctx.step(in_token=server_token)
+                except Exception:
+                    LOGGER.warning('Kerberos mutual authentication failed for %s', hostname)


Enforce required mutual-auth verification

In mutual_authentication='required' mode, verification only runs when a token exists and any verification failure is swallowed with a warning, so responses can still be accepted without successful mutual auth. This weakens the semantics of the required mode because missing or invalid server tokens are treated as success instead of failing the request.

Useful? React with 👍 / 👎.

mwdd146980 · 2026-02-20T23:48:24Z

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

Add Kerberos and NTLM auth adapters for HTTPXWrapper #22706 👈 (View in Graphite)
Forward instance config (auth, TLS, timeout, proxy, headers) to HTTPXWrapper #22705
Phase 2: HTTPXWrapper initial implementation #22704
Feature branch for httpx migration #22676 : 3 other dependent PRs (#22710 , #22722 , #22864 )
master

This stack of pull requests is managed by Graphite. Learn more about stacking.

codecov · 2026-02-21T00:19:33Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.48%. Comparing base (3901269) to head (8142f0b).

Additional details and impacted files

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

- Add KerberosAuth(httpx.Auth) using spnego for GSSAPI/Kerberos negotiate: preemptive and non-preemptive modes, mutual auth, delegate, keytab - Add NTLMAuth(httpx.Auth) using spnego for three-step NTLM handshake: Type1 Negotiate -> Type2 Challenge -> Type3 Authenticate - Wire both adapters into _build_httpx_client for auth_type=kerberos/ntlm - spnego loaded via lazy_loader; no startup cost when auth not used - Add test_httpx_auth.py with 12 tests covering all auth flows using mocked spnego Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

mwdd146980 requested a review from a team as a code owner February 20, 2026 23:41

datadog-agent-integrations-bot bot added base_package team/agent-integrations labels Feb 20, 2026

mwdd146980 marked this pull request as draft February 20, 2026 23:42

chatgpt-codex-connector bot reviewed Feb 20, 2026

View reviewed changes

This was referenced Feb 20, 2026

Feature branch for httpx migration #22676

Draft

Phase 2: HTTPXWrapper initial implementation #22704

Draft

mwdd146980 mentioned this pull request Feb 20, 2026

Forward instance config (auth, TLS, timeout, proxy, headers) to HTTPXWrapper #22705

Draft

3 tasks

mwdd146980 force-pushed the mwdd146980/phase3-httpx-config-parity branch from 39234c0 to baef5ae Compare February 23, 2026 14:24

mwdd146980 force-pushed the mwdd146980/phase3-httpx-auth-adapters branch from 5a613fa to 4812725 Compare February 23, 2026 14:24

mwdd146980 force-pushed the mwdd146980/phase3-httpx-config-parity branch from baef5ae to f3d3b4d Compare February 23, 2026 14:47

mwdd146980 force-pushed the mwdd146980/phase3-httpx-auth-adapters branch 2 times, most recently from 25568d5 to 2a078ba Compare February 25, 2026 02:29

mwdd146980 force-pushed the mwdd146980/phase3-httpx-config-parity branch from f3d3b4d to db8c5bd Compare February 25, 2026 02:29

mwdd146980 mentioned this pull request Mar 2, 2026

Add mock_http fixture; migrate 9 intg to mock_http #22710

Merged

3 tasks

mwdd146980 force-pushed the mwdd146980/phase3-httpx-auth-adapters branch from 2a078ba to bee9cdb Compare March 2, 2026 22:07

mwdd146980 force-pushed the mwdd146980/phase3-httpx-config-parity branch 2 times, most recently from 77875b8 to ce64c85 Compare March 2, 2026 22:53

mwdd146980 force-pushed the mwdd146980/phase3-httpx-auth-adapters branch from bee9cdb to 4fe7683 Compare March 2, 2026 22:53

mwdd146980 force-pushed the mwdd146980/phase3-httpx-auth-adapters branch from 4fe7683 to 8142f0b Compare March 2, 2026 23:06

mwdd146980 force-pushed the mwdd146980/phase3-httpx-config-parity branch from ce64c85 to 3901269 Compare March 2, 2026 23:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Kerberos and NTLM auth adapters for HTTPXWrapper#22706

Add Kerberos and NTLM auth adapters for HTTPXWrapper#22706
mwdd146980 wants to merge 1 commit intomwdd146980/phase3-httpx-config-parityfrom
mwdd146980/phase3-httpx-auth-adapters

mwdd146980 commented Feb 20, 2026

Uh oh!

datadog-datadog-prod-us1 bot commented Feb 20, 2026 •

edited by datadog-datadog-prod-us1-2 bot

Loading

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Feb 20, 2026

Uh oh!

chatgpt-codex-connector bot Feb 20, 2026

Uh oh!

chatgpt-codex-connector bot Feb 20, 2026

Uh oh!

mwdd146980 commented Feb 20, 2026 •

edited

Loading

Uh oh!

codecov bot commented Feb 21, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		ctx = self._build_context(hostname)
		token = ctx.step(in_token=server_token)

Conversation

mwdd146980 commented Feb 20, 2026

Summary

Test plan

Uh oh!

datadog-datadog-prod-us1 bot commented Feb 20, 2026 • edited by datadog-datadog-prod-us1-2 bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

ℹ️ Info

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

mwdd146980 commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

datadog-datadog-prod-us1 bot commented Feb 20, 2026 •

edited by datadog-datadog-prod-us1-2 bot

Loading

mwdd146980 commented Feb 20, 2026 •

edited

Loading

codecov bot commented Feb 21, 2026 •

edited

Loading