search

jcmturner / gokrb5

Pure Go Kerberos library for clients and services
Apache License 2.0
729 stars 253 forks source link

Decrypting ticket on initiator/client side #529

Open bodgit opened 1 year ago

bodgit commented 1 year ago

Assuming I have the following code:

ticket, skey, err := cl.GetServiceTicket(spn)
if err != nil {
        panic(err)
}

...

Is there a way to decrypt the ticket on the initiator/client side? I tried perhaps naively using ticket.Decrypt(skey) however that returns error decrypting Ticket EncPart: error decrypting: integrity verification failed so perhaps that's not the correct key to use.

Specifically, I'd like to get at the ticket timing fields on the initiator/client side which don't seem to be exported in an obvious way. For now, I can calculate an approximate end time with time.Now().Add(cl.Config.LibDefaults.TicketLifetime) but that's slightly inaccurate.