dotnet / Kerberos.NET

A Kerberos implementation built entirely in managed code.
MIT License
515 stars 90 forks source link

Error 401 while using generated kerberos ticket #370

Closed DanielMGoldberg closed 3 weeks ago

DanielMGoldberg commented 3 months ago

I'm currently working on generating a Kerberos ticket using the Kerberos.Net NuGet package. My objective is to use this ticket to authenticate and access a third-party API. However, despite my efforts, I am encountering a 401 Unauthorized error.

string keyTabFilePath = "myPath" var krb5Config = new Krb5Config(); // settings some kdc configurations.

using(var client = new KerberosClient(krb5Config)) { var keytab= new KeyTable(File.ReadAllBytes(keyTabFilePath)); var kerbCred = new KeytabCredential("myUser.corp", keytab);

await client.Authenticate(kerbCred); var ticket = await client.GetServiceTicket("zzz/x.corp"); var token = Convert.ToBase64String(ticket.EncodingGssApi().ToArray());

HttpClientHandler handler = new HttpClientHandler() { UseDefaultCredentials = false } using(HttpClient client = new HttpClient(handler)) { client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Negotiate", token); HttpResponseMessage response = client.GetAsync(apiUrl).Result; }

}

I'm using this code to generate a Kerberos ticket and authenticate to access a third-party API. The expected outcome is to receive a 200 HTTP status code, indicating a successful request. However, I'm currently receiving a 401 Unauthorized error.

I'm sure I'm missing something. Thank you in advance for your help.

Best regards,

SteveSyfuhs commented 3 months ago

Well why is the server responding 401? The library worked as intended. You got a ticket to use.


From: DanielMGoldberg @.> Sent: Monday, June 17, 2024 2:15:08 AM To: dotnet/Kerberos.NET @.> Cc: Subscribed @.***> Subject: [dotnet/Kerberos.NET] Error 401 while using generated kerberos ticket (Issue #370)

I'm currently working on generating a Kerberos ticket using the Kerberos.Net NuGet package. My objective is to use this ticket to authenticate and access a third-party API. However, despite my efforts, I am encountering a 401 Unauthorized error.

string keyTabFilePath = "myPath" var krb5Config = new Krb5Config(); // settings some kdc configurations.

using(var client = new KerberosClient(krb5Config)) { var keytab= new KeyTable(File.ReadAllBytes(keyTabFilePath)); var kerbCred = new KeytabCredential("myUser.corp", keytab);

await client.Authenticate(kerbCred); var ticket = await client.GetServiceTicket("zzz/x.corp"); var token = Convert.ToBase64String(ticket.EncodingGssApi().ToArray());

HttpClientHandler handler = new HttpClientHandler() { UseDefaultCredentials = false } using(HttpClient client = new HttpClient(handler)) { client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Negotiate", token); HttpResponseMessage response = client.GetAsync(apiUrl).Result; }

}

I'm using this code to generate a Kerberos ticket and authenticate to access a third-party API. The expected outcome is to receive a 200 HTTP status code, indicating a successful request. However, I'm currently receiving a 401 Unauthorized error.

I'm sure I'm missing something. Thank you in advance for your help.

Best regards,

— Reply to this email directly, view it on GitHubhttps://github.com/dotnet/Kerberos.NET/issues/370 or unsubscribehttps://github.com/notifications/unsubscribe-auth/AAJHTYO4C7NPWW5OSAX7BRDZH2SJ3BFKMF2HI4TJMJ2XIZLTSSBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJLJONZXKZNENZQW2ZNLORUHEZLBMRPXI6LQMWBKK5TBNR2WLKJVGY2DENZSGM2TLJDOMFWWLKLIMFZV63DBMJSWZAVFOZQWY5LFUR2HE5LFURXGC3LFVZ3WC5DDNBPWCY3UNF3GS5DZVRZXKYTKMVRXIX3UPFYGLJKJONZXKZNGORXXA2LDOOJYFJDUPFYGLKTSMVYG643JORXXE6NFOZQWY5LFVA4DKNBYHEYTGOECUR2HS4DFUVUXG43VMWSXMYLMOVS2UMRTGU3DQMZQHEZTNAVEOR4XAZNFNRQWEZLMUV3GC3DVMWUTKNRUGI3TEMZVGWTXI4TJM5TWK4VGMNZGKYLUMU. You are receiving this email because you are subscribed to this thread.

Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

DanielMGoldberg commented 3 months ago

Well why is the server responding 401? The library worked as intended. You got a ticket to use. ____ From: DanielMGoldberg @.> Sent: Monday, June 17, 2024 2:15:08 AM To: dotnet/Kerberos.NET @.> Cc: Subscribed @.***> Subject: [dotnet/Kerberos.NET] Error 401 while using generated kerberos ticket (Issue #370) I'm currently working on generating a Kerberos ticket using the Kerberos.Net NuGet package. My objective is to use this ticket to authenticate and access a third-party API. However, despite my efforts, I am encountering a 401 Unauthorized error. string keyTabFilePath = "myPath" var krb5Config = new Krb5Config(); // settings some kdc configurations. using(var client = new KerberosClient(krb5Config)) { var keytab= new KeyTable(File.ReadAllBytes(keyTabFilePath)); var kerbCred = new KeytabCredential("myUser.corp", keytab); await client.Authenticate(kerbCred); var ticket = await client.GetServiceTicket("zzz/x.corp"); var token = Convert.ToBase64String(ticket.EncodingGssApi().ToArray()); HttpClientHandler handler = new HttpClientHandler() { UseDefaultCredentials = false } using(HttpClient client = new HttpClient(handler)) { client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Negotiate", token); HttpResponseMessage response = client.GetAsync(apiUrl).Result; } } I'm using this code to generate a Kerberos ticket and authenticate to access a third-party API. The expected outcome is to receive a 200 HTTP status code, indicating a successful request. However, I'm currently receiving a 401 Unauthorized error. I'm sure I'm missing something. Thank you in advance for your help. Best regards, — Reply to this email directly, view it on GitHub<#370> or unsubscribehttps://github.com/notifications/unsubscribe-auth/AAJHTYO4C7NPWW5OSAX7BRDZH2SJ3BFKMF2HI4TJMJ2XIZLTSSBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJLJONZXKZNENZQW2ZNLORUHEZLBMRPXI6LQMWBKK5TBNR2WLKJVGY2DENZSGM2TLJDOMFWWLKLIMFZV63DBMJSWZAVFOZQWY5LFUR2HE5LFURXGC3LFVZ3WC5DDNBPWCY3UNF3GS5DZVRZXKYTKMVRXIX3UPFYGLJKJONZXKZNGORXXA2LDOOJYFJDUPFYGLKTSMVYG643JORXXE6NFOZQWY5LFVA4DKNBYHEYTGOECUR2HS4DFUVUXG43VMWSXMYLMOVS2UMRTGU3DQMZQHEZTNAVEOR4XAZNFNRQWEZLMUV3GC3DVMWUTKNRUGI3TEMZVGWTXI4TJM5TWK4VGMNZGKYLUMU. You are receiving this email because you are subscribed to this thread. Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

Hey I figured out the issue, I was using an outdated version therefore the GssEncoding was incorrect Secondly, I targeted the wrong spn to get the kerberos token.

I have another question, is it possible to configure a "master" spn this way I can generate from it a token relevant to all other services ?

SteveSyfuhs commented 3 months ago

No. That would defeat every security property kerberos provides.


From: DanielMGoldberg @.> Sent: Thursday, June 27, 2024 12:22:29 AM To: dotnet/Kerberos.NET @.> Cc: Comment @.>; Subscribed @.> Subject: Re: [dotnet/Kerberos.NET] Error 401 while using generated kerberos ticket (Issue #370)

Well why is the server responding 401? The library worked as intended. You got a ticket to use. … ____ From: DanielMGoldberg @.> Sent: Monday, June 17, 2024 2:15:08 AM To: dotnet/Kerberos.NET @.> Cc: Subscribed @.***> Subject: [dotnet/Kerberos.NET] Error 401 while using generated kerberos ticket (Issue #370https://github.com/dotnet/Kerberos.NET/issues/370) I'm currently working on generating a Kerberos ticket using the Kerberos.Net NuGet package. My objective is to use this ticket to authenticate and access a third-party API. However, despite my efforts, I am encountering a 401 Unauthorized error. string keyTabFilePath = "myPath" var krb5Config = new Krb5Config(); // settings some kdc configurations. using(var client = new KerberosClient(krb5Config)) { var keytab= new KeyTable(File.ReadAllBytes(keyTabFilePath)); var kerbCred = new KeytabCredential("myUser.corp", keytab); await client.Authenticate(kerbCred); var ticket = await client.GetServiceTicket("zzz/x.corp"); var token = Convert.ToBase64String(ticket.EncodingGssApi().ToArray()); HttpClientHandler handler = new HttpClientHandler() { UseDefaultCredentials = false } using(HttpClient client = new HttpClient(handler)) { client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Negotiate", token); HttpResponseMessage response = client.GetAsync(apiUrl).Result; } } I'm using this code to generate a Kerberos ticket and authenticate to access a third-party API. The expected outcome is to receive a 200 HTTP status code, indicating a successful request. However, I'm currently receiving a 401 Unauthorized error. I'm sure I'm missing something. Thank you in advance for your help. Best regards, — Reply to this email directly, view it on GitHub<#370https://github.com/dotnet/Kerberos.NET/issues/370> or unsubscribehttps://github.com/notifications/unsubscribe-auth/AAJHTYO4C7NPWW5OSAX7BRDZH2SJ3BFKMF2HI4TJMJ2XIZLTSSBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJLJONZXKZNENZQW2ZNLORUHEZLBMRPXI6LQMWBKK5TBNR2WLKJVGY2DENZSGM2TLJDOMFWWLKLIMFZV63DBMJSWZAVFOZQWY5LFUR2HE5LFURXGC3LFVZ3WC5DDNBPWCY3UNF3GS5DZVRZXKYTKMVRXIX3UPFYGLJKJONZXKZNGORXXA2LDOOJYFJDUPFYGLKTSMVYG643JORXXE6NFOZQWY5LFVA4DKNBYHEYTGOECUR2HS4DFUVUXG43VMWSXMYLMOVS2UMRTGU3DQMZQHEZTNAVEOR4XAZNFNRQWEZLMUV3GC3DVMWUTKNRUGI3TEMZVGWTXI4TJM5TWK4VGMNZGKYLUMU. You are receiving this email because you are subscribed to this thread. Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

Hey I figured out the issue, I was using an outdated version therefore the GssEncoding was incorrect Secondly, I targeted the wrong spn to get the kerberos token.

I have another question, is it possible to configure a "master" spn this way I can generate from it a token relevant to all other services ?

— Reply to this email directly, view it on GitHubhttps://github.com/dotnet/Kerberos.NET/issues/370#issuecomment-2193976299 or unsubscribehttps://github.com/notifications/unsubscribe-auth/AAJHTYIZRWKZXINE574I3HTZJO4TLBFKMF2HI4TJMJ2XIZLTSSBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDUOJ2WLJDOMFWWLLTXMF2GG2C7MFRXI2LWNF2HTAVFOZQWY5LFUVUXG43VMWSG4YLNMWVXI2DSMVQWIX3UPFYGLAVFOZQWY5LFVE2TMNBSG4ZDGNJVURXGC3LFVFUGC427NRQWEZLMVRZXKYTKMVRXIX3UPFYGLLCJONZXKZKDN5WW2ZLOOSTHI33QNFRXHE4CUR2HS4DFVJZGK4DPONUXI33SPGSXMYLMOVS2QOBVGQ4DSMJTHCBKI5DZOBS2K2LTON2WLJLWMFWHKZNKGIZTKNRYGMYDSMZWQKSHI6LQMWSWYYLCMVWKK5TBNR2WLKJVGY2DENZSGM2TLJ3UOJUWOZ3FOKTGG4TFMF2GK. You are receiving this email because you commented on the thread.

Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

DanielMGoldberg commented 3 weeks ago

Thanks, it works now. I'll close the issue :)