sfu

import "github.com/TheManticoreProject/Manticore/network/kerberos/v5/sfu"

Package sfu implements the Microsoft Service for User and Constrained Delegation extensions ([MS-SFU]) that layer onto RFC 4120’s TGS exchange: PA-FOR-USER (S4U2Self) and the padata used for S4U2Proxy. Like the rest of the MS extensions, these ride the RFC’s padata / additional-tickets extension points — the TGS-REQ/REP messages are unchanged.

Index

• func BuildPAForUser(userName messages.PrincipalName, userRealm string, sessionKey []byte, sessionKeyEType int) (messages.PAData, error)
• func VerifyPAForUser(p *PAForUser, sessionKey []byte, sessionKeyEType int) bool
• type PAForUser
  • func ParsePAForUser(b []byte) (*PAForUser, error)

func BuildPAForUser

func BuildPAForUser(userName messages.PrincipalName, userRealm string, sessionKey []byte, sessionKeyEType int) (messages.PAData, error)

BuildPAForUser builds the PA-FOR-USER pre-authentication data element used in an S4U2Self TGS-REQ, on behalf of the user (userName, userRealm). The keyed checksum is computed with the requesting service’s TGT session key at key usage KERB_NON_KERB_CKSUM_SALT (17).

[MS-SFU] 2.2.1 specifies KERB_CHECKSUM_HMAC_MD5, which is correct when the TGT session key is RC4. For AES TGT session keys, modern KDCs expect the checksum type paired with the session key’s enctype; this function selects that type from sessionKeyEType so it interoperates with current Active Directory.

func VerifyPAForUser

func VerifyPAForUser(p *PAForUser, sessionKey []byte, sessionKeyEType int) bool

VerifyPAForUser recomputes the PA-FOR-USER checksum with the given TGT session key and reports whether it matches, defending against tampering with the impersonated identity.

type PAForUser

PAForUser is the decoded content of a PA-FOR-USER element.

type PAForUser struct {
    UserName    messages.PrincipalName
    UserRealm   string
    Cksum       messages.Checksum
    AuthPackage string
}

func ParsePAForUser

func ParsePAForUser(b []byte) (*PAForUser, error)

ParsePAForUser decodes a PA-FOR-USER padata-value.