[kitten] OT: MS Kerb constrained delegation, tickets with KRB_NT

[kitten] OT: MS Kerb constrained delegation, tickets with KRB_NT_ENTERPRISE

mrex@sap.com (Martin Rex) Wed, 27 November 2013 22:59 UTC

To: kitten@ietf.org
Date: Wed, 27 Nov 2013 23:59:31 +0100
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="US-ASCII"
Message-Id: <20131127225931.08F211AB0B@ld9781.wdf.sap.corp>
From: mrex@sap.com
Subject: [kitten] OT: MS Kerb constrained delegation, tickets with KRB_NT_ENTERPRISE
Precedence: list
Reply-To: mrex@sap.com

Sorry for a slightly OT question about a Kerberos protocol/interop issue.
What is the exact purpose and semantics of a Kerberos Ticket that contains
a KRB_NT_ENTERPRISE cname for the receiver of the AP_REQ (the acceptor)?

The usage scenario is Microsoft Kerberos using constrained delegation
(a web server plugin in some Sharepoint environment).

That web server plugin was written in .NET and passes the Client UPN
it receives from Sharepoint "User@example.com" to "S4UClient.UpnLogon()",
and according to the Wireshark trace, results in a KRB_TGS_REP with

  http://tools.ietf.org/html/rfc4120#section-5.4.2

  crealm = "EXAMPLE.COM"
  cname  = { KRB_NT_ENTERPRISE, "User@example.com" }

When a Microsoft Kerberos Acceptor processes the resulting AP_REQ,
it appears to return "User@EXAMPLE.COM@EXAMPLE.COM" from
QueryContextAttributes(NATIVE_NAMES), which will be rejected by the
application caller since it does not match the name as it appears on
the ACL ("User@EXAMPLE.COM")

When the Webserver plugin is modified to strip the domain/realm
before passing it to S4UClient.UpnLogon(), then the resulting
ticket seems to contain:

  crealm = "EXAMPLE.COM"
  cname  = { KRB_NT_ENTERPRISE, "User" }

and the Microsoft Kerberos Acceptor will return "User@EXAMPLE.COM"
from QueryContextAttributes(NATIVE_NAMES), i.e. something that the server
can match.


I believe something is going wrong, but wondering where:

  - client/initiator in creating KRB_TGS_REQ ?
  - KDC in creating KRB_TGS_REP ?
  - server/acceptor in processing AS_REQ and creating
    (the equivalent of) src_name for gss_accept_sec_context ?


My world is GSS-API and I'm no Kerberos protocol wrangler.
This issue was reported to me by a customer, I have no personal
experience with programming .NET, IIS-plugins and constrained
delegation.  But my "gsskrb5.dll" wrapper for the Microsoft Kerberos SSP
was used during impersonation/delegation for authenticating to our backend
application, and the wrong Username popped up at the backend.

-Martin

[kitten] OT: MS Kerb constrained delegation, tick… Martin Rex