Add Channel Binding support (Extended Protection for Authentication (EPA))

[cryptomilk]

We are using requests-gssapi in cepces for Certificate Auto Enrollment. cepces stopped working against Windows Server 2025 because we do not have support for channel binding aka Extended Protection for Authentication. This is required by default now: https://msrc.microsoft.com/blog/2024/12/mitigating-ntlm-relay-attacks-by-default/

We moved from requests-kerberos to requests-gssapi some time ago. But looking at the changelog of requests-kerberos it got support for channel binding. Could you please implement it for requests-gssapi too?

Thanks

[simo5]

https://datatracker.ietf.org/doc/html/rfc5929#section-4 tls-server-end-point is the binding that MS wants to be used, it needs access to the server's certificate to extract its hash.

[cryptomilk]

I need channel binding support for HTTPSPNEGOAuth()

[Neustradamus]

@cryptomilk: Thanks for your ticket :)

Linked to:

• Add Channel Binding support (Extended Protection for Authentication (EPA)) #56
• Support GSSAPI channel bindings #57

Linked to Channel Binding:

• State of Play scram-sasl/info#1