serviceprincipalname

import "github.com/TheManticoreProject/Manticore/windows/kerberos/serviceprincipalname"

Package serviceprincipalname implements a parser, validator and renderer for Kerberos Service Principal Names (SPNs).

An SPN is the name a client uses to identify a service for mutual authentication. Per [MS-ADTS] it is a string with the format:

serviceclass "/" hostname [":"port | ":"instancename] ["/" servicename]

An SPN consists of either two parts or three parts, each separated by a forward slash ("/"). The first part is the service class, the second part is the host name, and the third part (if present) is the service name. The host name part can optionally be suffixed with either a “:port” component or a “:instancename” component. A port component is distinguished from an instancename component by being entirely composed of numeric digits.

For example, “ldap/dc-01.fabrikam.com/fabrikam.com” is a three-part SPN where “ldap” is the service class name, “dc-01.fabrikam.com” is the host name, and “fabrikam.com” is the service name.

Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/cd328386-4d97-4666-be33-056545c1cad2

Index

type ServicePrincipalName

type ServicePrincipalName

ServicePrincipalName represents a parsed Kerberos SPN of the form:

serviceclass "/" hostname [":"port | ":"instancename] ["/" servicename]

Exactly one of Port (non-zero) or InstanceName (non-empty) may be set: the “:”-suffix on the host name is interpreted as a port when it is composed entirely of numeric digits, and as an instance name otherwise.

type ServicePrincipalName struct {
    // ServiceClass is the first part of the SPN (e.g. "ldap", "cifs",
    // "MSSQLSvc", "HTTP"). It is required.
    ServiceClass string

    // Hostname is the host portion of the second part of the SPN, with any
    // ":port" or ":instancename" suffix removed. It is required.
    Hostname string

    // Port is the value of the optional numeric ":port" suffix on the host
    // name. It is 0 when no numeric port suffix is present.
    Port uint16

    // InstanceName is the value of the optional non-numeric ":instancename"
    // suffix on the host name. It is empty when no such suffix is present.
    InstanceName string

    // ServiceName is the optional third part of the SPN. It is empty for a
    // two-part SPN.
    ServiceName string
}

func FromString

func FromString(spn string) (*ServicePrincipalName, error)

FromString parses spn into a ServicePrincipalName and validates it.

It returns an error when spn is empty, has fewer than two or more than three “/”-separated parts, contains an empty component, or carries a numeric port suffix that does not fit in a uint16.

func (*ServicePrincipalName) Equal

func (s *ServicePrincipalName) Equal(other *ServicePrincipalName) bool

Equal reports whether s and other describe the same SPN. Comparison is case-insensitive, matching the case-insensitive handling of SPNs in Kerberos and Active Directory.

func (*ServicePrincipalName) HasServiceName

func (s *ServicePrincipalName) HasServiceName() bool

HasServiceName reports whether the SPN is a three-part SPN (i.e. it carries a service name).

func (*ServicePrincipalName) IsValid

func (s *ServicePrincipalName) IsValid() bool

IsValid reports whether the ServicePrincipalName is well-formed. It is a boolean convenience wrapper over Validate.

func (*ServicePrincipalName) String

func (s *ServicePrincipalName) String() string

String renders the canonical SPN string. For a value produced by FromString the result round-trips back to an equal ServicePrincipalName.

func (*ServicePrincipalName) Validate

func (s *ServicePrincipalName) Validate() error

Validate checks that the ServicePrincipalName is well-formed: the service class and host name are present, at most one of Port/InstanceName is set, and no component contains a separator ("/" or “:”) that would break round-tripping through String.

FromString calls Validate before returning, so any value produced by FromString is valid. Validate is intended for values constructed by hand.