Kerberos auth with GSSAPI for Mac

Sun, 09 Mar 2025 13:07:54 +0530

Fix macOS: Dynamically Detect Homebrew-installed GSSAPI Library

Problem:

On macOS, the GSSAPI library path is hardcoded as /usr/lib/libgssapi_krb5.dylib. However, when installed via Homebrew, the library is located in /opt/homebrew/lib/libgssapi_krb5.dylib (or /usr/local/lib/... for Intel Macs).

This causes ffi_lib to fail unless the user manually modifies the path.

Solution:

Used File.exist? to check if the Homebrew-installed library exists.
If found, used brew --prefix to dynamically get the correct path.
Falls back to /usr/lib/libgssapi_krb5.dylib if Homebrew is not installed.

Code Changes:

Updated lib_gssapi_loader.rb to:

when /darwin/
 brew_prefix = `brew --prefix`.strip rescue nil
 gssapi_lib = if brew_prefix && !brew_prefix.empty?
 "#{brew_prefix}/lib/libgssapi_krb5.dylib"
 else
 "/usr/lib/libgssapi_krb5.dylib"
 end
 ffi_lib gssapi_lib, FFI::Library::LIBC

Gssapi on CrippledMind's InfoSec Journal

Kerberos auth with GSSAPI for Mac

Fix macOS: Dynamically Detect Homebrew-installed GSSAPI Library

Problem:

Solution:

Code Changes: