SteveSyfuhs
commented
7 months ago The Invalid Checksum error means the key used to decrypt the incoming AP-REQ is wrong. Since it's pulling the key from KeyTable table = new KeyTable(File.ReadAllBytes()) that would suggest the keytable either has the wrong key or no key at all (though no key should trigger a different error).
You can test this by ruling out any oddities with KeyTable lookups with something like this:
foreach (var entry in keyTable.Entries)
{
KerberosAuthenticator authenticator = new KerberosAuthenticator(new KerberosValidator(entry.Key));
try
{
var identity = await authenticator.Authenticate(token);
}
catch (Exception ex)
{
// blah
}
}If it is a key selection issue then I can make that logic a bit smarter based on what you happen to find with the above test.
ldapcoder
I have written an LDAP server that, among other things, processes Kerberos authentications. I had been using an old C SSPI library to process these authentications, but would like to use Kerberos.NET for a multitude of reasons. My code looks like:
byte[] token = ... (parsed Kerberos request bytes from incoming request)
KeyTable table = new KeyTable(File.ReadAllBytes());
KerberosAuthenticator authenticator = new KerberosAuthenticator(table);
Task authenticateTask = authenticator.Authenticate(token);
authenticateTask.Wait();
KerberosIdentity claimsIdentity = (KerberosIdentity)authenticateTask.Result;
I am getting an exception with the following stacktrace when calling authenticateTask.Wait():
System.AggregateException: One or more errors occurred. ---> System.Security.SecurityException: Invalid checksum at Kerberos.NET.Crypto.AESTransformer.Decrypt(ReadOnlyMemoryd15.MoveNext() in D:\a\1\s\Kerberos.NET\KerberosValidator.cs:line 75
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Kerberos.NET.KerberosAuthenticator.d 13.MoveNext() in D:\a\1\s\Kerberos.NET\KerberosAuthenticator.cs:line 73
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Kerberos.NET.KerberosAuthenticator.d12.MoveNext() in D:\a\1\s\Kerberos.NET\KerberosAuthenticator.cs:line 69
--- End of inner exception stack trace ---
at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions)
at System.Threading.Tasks.Task.Wait(Int32 millisecondsTimeout, CancellationToken cancellationToken)
at System.Threading.Tasks.Task.Wait()
at LdapSession.d 58.MoveNext() in LdapSession.cs:line 629
---> (Inner Exception #0) System.Security.SecurityException: Invalid checksum
at Kerberos.NET.Crypto.AESTransformer.Decrypt(ReadOnlyMemoryd15.MoveNext() in D:\a\1\s\Kerberos.NET\KerberosValidator.cs:line 75
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Kerberos.NET.KerberosAuthenticator.d 13.MoveNext() in D:\a\1\s\Kerberos.NET\KerberosAuthenticator.cs:line 73
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Kerberos.NET.KerberosAuthenticator.d__12.MoveNext() in D:\a\1\s\Kerberos.NET\KerberosAuthenticator.cs:line 69
The Zone of the assembly that failed was:
MyComputer<---
1 cipher, KerberosKey kerberosKey, KeyUsage usage) in D:\a\1\s\Kerberos.NET\Crypto\AES\AESTransformer.cs:line 112 at Kerberos.NET.Entities.KrbEncryptedData.Decrypt[T](KerberosKey key, KeyUsage usage, Func2 func) in D:\a\1\s\Kerberos.NET\Entities\Krb\KrbEncryptedData.cs:line 39 at Kerberos.NET.Crypto.DecryptedKrbApReq.Decrypt(KerberosKey ticketEncryptingKey) in D:\a\1\s\Kerberos.NET\Crypto\DecryptedKrbApReq.cs:line 75 at Kerberos.NET.Entities.ContextToken.DecryptApReq(KrbApReq token, KeyTable keytab) in D:\a\1\s\Kerberos.NET\Entities\SpNego\ContextToken.cs:line 45 at Kerberos.NET.KerberosValidator.1 cipher, KerberosKey kerberosKey, KeyUsage usage) in D:\a\1\s\Kerberos.NET\Crypto\AES\AESTransformer.cs:line 112 at Kerberos.NET.Entities.KrbEncryptedData.Decrypt[T](KerberosKey key, KeyUsage usage, Func2 func) in D:\a\1\s\Kerberos.NET\Entities\Krb\KrbEncryptedData.cs:line 39 at Kerberos.NET.Crypto.DecryptedKrbApReq.Decrypt(KerberosKey ticketEncryptingKey) in D:\a\1\s\Kerberos.NET\Crypto\DecryptedKrbApReq.cs:line 75 at Kerberos.NET.Entities.ContextToken.DecryptApReq(KrbApReq token, KeyTable keytab) in D:\a\1\s\Kerberos.NET\Entities\SpNego\ContextToken.cs:line 45 at Kerberos.NET.KerberosValidator.