search

jcmturner / gokrb5

Pure Go Kerberos library for clients and services
Apache License 2.0
723 stars 245 forks source link

support adding AES keytab entries for Active Directory #484

Open rilott opened 2 years ago

rilott commented 2 years ago

Microsoft active directory uses it's own AES salt for keytab entries. This PR adds a new function AddActiveDirectoryComputerAccountEntry which handles this, and doesn't modify the normal AddEntry function.

I tried to add this with minimal code changes/duplication.

Partially fixes #416 (computer accounts only) All tests pass

Thanks! Ross

gaxelac0 commented 1 year ago

The methods worked for me as the salt for the tickets emitted by Active Directory comes with the format DOMAINsamAccountName

And gokrb5 tries to generate a salt with cname.GetSalt method, concatenating all the Names of the SPN which is wrong, ending with something like this: DOMAINHTTPservicePrincipalName.DOMAIN

With the salt like that, the decryption will fail.