search

AgNO3 / jcifs-ng

A cleaned-up and improved version of the jCIFS library
GNU Lesser General Public License v2.1
318 stars 103 forks source link

kerberos constrained delegation not working #116

Open dariusan opened 6 years ago

dariusan commented 6 years ago

There seem to be problems regarding "constrained" ticket delegation resulting in an error: "No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)" whereas everything works fine with "unconstrained" ticket delegation. Is there a fix?

mbechler commented 6 years ago

I suppose you are talking about S4U2Proxy there, right? I think what that would need is the ability to pass your impersonated GSSCredential down to the authentication context.

dariusan commented 6 years ago

Yes, the existing jcifs-ng code works already with "unconstrained delegation", since it can access ticket granting tickets (tgt). Java 8 and above support also "constrained delegation" where no "tgt" are given to the service anymore. I have an ugly but working patch of Kerb5Context where I add the GSSCredential when creating a GSSContext and jcifs-ng can access file shares successfully with "constrained delegation", i.e. impersonated users.

arvindmaan commented 3 years ago

It would be nice to have this enhancement through library support for kerberos S4U2Self and S4U2Proxy.

arvindmaan commented 3 years ago

@dariusan i am trying to achieve S4U2Proxy, tried multiple approaches but no luck, ending up all kind of errors. KrbException: KDC cannot accommodate requested option (13) at java.security.jgss/sun.security.krb5.KrbTgsRep.(KrbTgsRep.java:70) at java.security.jgss/sun.security.krb5.KrbTgsReq.getReply(KrbTgsReq.java:251) at java.security.jgss/sun.security.krb5.KrbTgsReq.sendAndGetCreds(KrbTgsReq.java:262) at java.security.jgss/sun.security.krb5.internal.CredentialsUtil.acquireS4U2proxyCreds(CredentialsUtil.java:96) at java.security.jgss/sun.security.krb5.Credentials.acquireS4U2proxyCreds(Credentials.java:477) at java.security.jgss/sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:701) at java.security.jgss/sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:266) at java.security.jgss/sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:196) at jcifs.smb.Kerb5Context.initSecContext(Kerb5Context.java:328)

if feasible can you please share patch to fix constrained delegation issue ?

mbechler commented 3 years ago

Happy to incooperate the necessary changes, if someone can share the details on what information needs to be passed down and which GSSAPI calls are required.