Add auth_protocol support to SambaHook for Kerberos authentication #29590

[haseebmalik18]

Add auth_protocol parameter to SambaHook to support Kerberos, NTLM, and negotiate authentication. Previously the hook always used username/password auth, ignoring the {"auth": "kerberos"} connection extra, which caused SpnegoError failures for Kerberos-configured connections.

closes: #29590

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds configurable auth_protocol support to SambaHook to enable Kerberos / NTLM / negotiate auth selection and fixes prior behavior where Kerberos-configured connections were ignored.

Changes:

• Introduces auth_protocol handling in SambaHook, including validation and an optional Kerberos dependency check.
• Adds unit tests covering Kerberos (including legacy extra={"auth": "kerberos"}), NTLM, invalid protocol handling, and missing dependency behavior.
• Exposes auth_protocol in the Airflow connection UI and adds a kerberos extra dependency group for the provider.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 4 comments.

File	Description
providers/samba/src/airflow/providers/samba/hooks/samba.py	Implements auth_protocol parsing/validation, Kerberos dependency guard, passes protocol through to smbclient, and adds UI widget.
providers/samba/tests/unit/samba/hooks/test_samba.py	Expands tests to cover new auth protocol behaviors and error cases.
providers/samba/pyproject.toml	Adds kerberos optional dependency group intended to support Kerberos auth.

[potiuk]

Sorry - we missed that there is an open question to us - > and the triage process closed it. Can you re-open and ping me again if you are still not completely put-off by that @haseebmalik18 ?

[github-actions]

uv.lock on main just moved via #68780 ("Bump zeep from 4.3.2 to 4.3.3"), commit e6c1ae6 and this PR currently conflicts.

Quickest fix:

git fetch upstream main && git rebase upstream/main
rm uv.lock && uv lock
git add uv.lock && git rebase --continue
git push --force-with-lease

Automated nudge — ignore if you're not ready to rebase. This comment is updated in place on future uv.lock bumps.

[haseebmalik18]

@potiuk ready for review, failing tests unrelated to PR