search

jcmturner / gokrb5

Pure Go Kerberos library for clients and services
Apache License 2.0
723 stars 245 forks source link

debugging unmarshal error #496

Open tooptoop4 opened 1 year ago

tooptoop4 commented 1 year ago

i am trying to use this lib to a host a httpserver on unix and let windows clients (AD) make curl calls to it with --negotiate -u :

SPNEGO error in unmarshaling SPNEGO token error unmarshalling KRB5Token OID: asn1: structure error: explicitly tagged member didn't match

b is [78 redactnumber redactnumber redactnumber redactnumber redactnumber redactnumber 0 1 0 0 0 redactnumber redactnumber 8 redactnumber 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 10 0 redactnumber 74 0 0 0 15]

https://github.com/jcmturner/gokrb5/blob/v8.4.3/v8/spnego/krb5Token.go#L71

curl shows Authorization: Negotiate a_56_char_length_string

I think NTLMSSP is what is getting sent to the http server, is that not supported?

tooptoop4 commented 1 year ago

with the https://github.com/jcmturner/gokrb5/blob/master/v8/examples/httpServer.go example getting:

* InitializeSecurityContext failed: SEC_E_INVALID_TOKEN (0x80090308) - The token supplied to the function is invalid
< Www-Authenticate: Negotiate oRQwEqADCgEBoQsGCSqGSIb3EgECAg==

i wonder if DisablePAFXFAST settings can be applied on service side? @jcmturner