# Rest API Calls with Kerebros Encryption **URL:** \ **Category:** Ignition\ **Tags:** scripting, ignition81\ **Created:** [March 25, 2025, 2:02pm UTC](https://forum.inductiveautomation.com/t/rest-api-calls-with-kerebros-encryption/104157 "2025-03-25T14:02:26Z")\ **Posts on this page:** 10\ **Page:** 2
**Author:** ![Cody\_Morgan](https://avatars.discourse-cdn.com/v4/letter/c/db5fbb/32.png) [@Cody\_Morgan](https://forum.inductiveautomation.com/u/Cody_Morgan)\ **Post date:** [May 6, 2025, 9:42pm UTC](https://forum.inductiveautomation.com/t/rest-api-calls-with-kerebros-encryption/104157/21 "2025-05-06T21:42:05Z")
Kevin mentioned a possible approach in his first reply to this post, I would explore that for getting Kerberos to work. Otherwise, I unfortunately don't know much about getting Kerberos to work in Ignition. I would definitely recommend getting something basic to work outside of Ignition _first_ so that you can separate any issues with authenticating to PI Web API from issues getting Kerberos to work in Ignition. PI Web API config is a pain to get correct. ---
**Author:** ![h.sumrain](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@h.sumrain](https://forum.inductiveautomation.com/u/h.sumrain)\ **Post date:** [May 7, 2025, 11:56am UTC](https://forum.inductiveautomation.com/t/rest-api-calls-with-kerebros-encryption/104157/22 "2025-05-07T11:56:43Z")
> [@Kevin.Herron](#): > > support for this kind of authentication in its HTTP cli Thanks Cody. One of the main issues I am facing in testing Kevin's approach is that I am unable to get the security files required for the AD admin. Not sure how to setup the credentials there. It can become a much easier task when there is a known tested procedure to successfully implement which is recommended by many. I am quite amazed that such a mechanic thing does not have a straight-forward SOP. I was able to get "Basic" to work without issues. The issue is how to make it work in Ignition without hardcoded credentials of any sort as this is unaccepted in any business. ---
**Author:** ![Cody\_Morgan](https://avatars.discourse-cdn.com/v4/letter/c/db5fbb/32.png) [@Cody\_Morgan](https://forum.inductiveautomation.com/u/Cody_Morgan)\ **Post date:** [May 7, 2025, 2:07pm UTC](https://forum.inductiveautomation.com/t/rest-api-calls-with-kerebros-encryption/104157/23 "2025-05-07T14:07:58Z")
> Kerberos in Ignition I reached out to our Sales Engineering team, and here is what they suggested: > We don't have a working example of this and it is not likely a very simple concept to implement like that. More than likely some java libraries will need to be used in order to authenticate with Kerberos. Here's a project that I have found that might be useful as a starting point, but would require either wrapping this in a module or rewriting it in a way to work within jython. > [kerberos-auth-example/src/main/java/net/curiousprogrammer/auth/kerberos/example/KerberosAuthExample.java at 953e9f157b0aadbcf27b0d9ca67c2ef014ed3062 · jumarko/kerberos-auth-example · GitHub](https://github.com/jumarko/kerberos-auth-example/blob/953e9f157b0aadbcf27b0d9ca67c2ef014ed3062/src/main/java/net/curiousprogrammer/auth/kerberos/example/KerberosAuthExample.java) Good luck, and if you get this to work, please do share with the rest of us! > I was able to get "Basic" to work without issues. The issue is how to make it work in Ignition without hardcoded credentials of any sort as this is unaccepted in any business. If it helps, there are a few topics on the forum related to secrets management, they can help give you some ideas on how to keep hardcoded credentials out of your Ignition scripts (if you can tolerate BASIC auth): > [@How are you hiding your API keys?](https://forum.inductiveautomation.com/t/how-are-you-hiding-your-api-keys/96689): > > I'm just curios how you guys are hiding you api key in the scripting module, are you hashing it in a database or something similar? Just looking for suggestions. Thanks! > [@Good way to make sure my gateway scripts only run on the server?](https://forum.inductiveautomation.com/t/good-way-to-make-sure-my-gateway-scripts-only-run-on-the-server/33777/): > > More of a design question than anything. I have gateway scripts, some of which involve emailing our companies clients. On occasion, I’ve had coworkers unknowingly backup the gateway to a development machine with an old database copy, and then all of a sudden our clients are getting emails with outdated information that they already received. Not great. Currently I’ve been telling people to not export/import gateway scripts, but there are other scripts that don’t involve emails that are essen… > [@Secrets management](https://forum.inductiveautomation.com/t/secrets-management/42205): > > I do a lot of API integrations, and right now I’ve got API authentication information in plain text in my scripts - however this is not a best practice. I’m wondering if there is a way to put secrets into a vault or key store in Ignition that I can reference in my scripts to tighten up my security. Newer versions of PI Web API support OIDC, which might be more doable? ---
**Author:** ![Cody\_Morgan](https://avatars.discourse-cdn.com/v4/letter/c/db5fbb/32.png) [@Cody\_Morgan](https://forum.inductiveautomation.com/u/Cody_Morgan)\ **Post date:** [May 7, 2025, 2:16pm UTC](https://forum.inductiveautomation.com/t/rest-api-calls-with-kerebros-encryption/104157/24 "2025-05-07T14:16:21Z")
@h.sumrain I have another idea, but it has not been thoroughly thought out-- You can probably configure a forward proxy that abstracts the authentication away from Ignition entirely. This should be possible, at least with BASIC auth. Ignition would send requests via the proxy without any authentication information (or maybe you have some other way to authenticate against the proxy), then the proxy can inject the BASIC auth headers before passing to PI Web API. If you don't want to authenticate against the proxy, you'll probably want to configure the proxy local to Ignition, and only accept connections from localhost. I'm not sure if its possible to configure a proxy to do something similar with Kerberos authentication. ---
**Author:** ![h.sumrain](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@h.sumrain](https://forum.inductiveautomation.com/u/h.sumrain)\ **Post date:** [May 7, 2025, 2:24pm UTC](https://forum.inductiveautomation.com/t/rest-api-calls-with-kerebros-encryption/104157/25 "2025-05-07T14:24:16Z")
Many thanks Cody. That sounds very creative. I just wonder why does it feel so hard to make Ignition work with Kerberos when it is native to Windows? Active Directory has been figured out long time ago most likely because it is native to Windows as well. Why would this be different or more difficult? Again, this is a mechanical thing and it would be great if Inductive figures/creates a solution for everyone. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 7, 2025, 2:45pm UTC](https://forum.inductiveautomation.com/t/rest-api-calls-with-kerebros-encryption/104157/26 "2025-05-07T14:45:35Z")
> [@h.sumrain](#): > > Active Directory has been figured out long time ago most likely because it is native to Windows as well. Why would this be different or more difficult? Java comes with LDAP support via [JNDI](https://docs.oracle.com/javase/tutorial/jndi/overview/index.html). It doesn't come with Kerberos support. Demand for Kerberos from customers has been nearly non-existent, and we're not particularly Windows focused unless needed. ---
**Author:** ![h.sumrain](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@h.sumrain](https://forum.inductiveautomation.com/u/h.sumrain)\ **Post date:** [May 7, 2025, 3:03pm UTC](https://forum.inductiveautomation.com/t/rest-api-calls-with-kerebros-encryption/104157/27 "2025-05-07T15:03:29Z")
Thanks Kevin. One of the unique capabilities in Ignition is its power of mixing between the powers of Java and Python under Jython, getting super powers from both. Isn't there a creative way to get Kerebros to work? May you please look at my suggested approach and at least share a theoretical evaluation of it? Inductive might not be Windows focused but it seems that many of the users are. When I have the choice, I usually favor linux-based servers but the common modern trend of using VMs helped shift the decision making on this matter to other departments with different priorities and requirements. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 7, 2025, 3:07pm UTC](https://forum.inductiveautomation.com/t/rest-api-calls-with-kerebros-encryption/104157/28 "2025-05-07T15:07:09Z")
The very first reply you got in this thread was a lead on a creative way to get it to work. See [Rest API Calls with Kerebros Encryption - #2 by Kevin.Herron](https://forum.inductiveautomation.com/t/rest-api-calls-with-kerebros-encryption/104157/2) I don't have a local Windows environment nor a Kerberos environment set up to even poke at this with, and I don't really know what any of the ChatGPT/LLM-generated approach you pasted in here is about. ---
**Author:** ![h.sumrain](https://avatars.discourse-cdn.com/v4/letter/h/f9ae1b/32.png) [@h.sumrain](https://forum.inductiveautomation.com/u/h.sumrain)\ **Post date:** [May 7, 2025, 3:16pm UTC](https://forum.inductiveautomation.com/t/rest-api-calls-with-kerebros-encryption/104157/29 "2025-05-07T15:16:16Z")
I will try to poke around with the details in the link you shared. I agree with you on the LLM-generated approach but I came across it on a controls forum somewhere. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [May 7, 2025, 3:32pm UTC](https://forum.inductiveautomation.com/t/rest-api-calls-with-kerebros-encryption/104157/30 "2025-05-07T15:32:36Z")
You might try reaching out to Sales Engineering... they may be able to help you out. If nothing else that kind of registers your interest in Kerberos via an official channel. [Previous page](https://forum.inductiveautomation.com/t/rest-api-calls-with-kerebros-encryption/104157.md?page=1)