{"action":"created","issue":{"url":"https://api.github.com/repos/jcmturner/gokrb5/issues/99","repository_url":"https://api.github.com/repos/jcmturner/gokrb5","labels_url":"https://api.github.com/repos/jcmturner/gokrb5/issues/99/labels{/name}","comments_url":"https://api.github.com/repos/jcmturner/gokrb5/issues/99/comments","events_url":"https://api.github.com/repos/jcmturner/gokrb5/issues/99/events","html_url":"https://github.com/jcmturner/gokrb5/issues/99","id":303254641,"number":99,"title":"Cannot SPNEGO to hosts whose credentials exist in the ccache","user":{"login":"dkfitbit","id":18060512,"avatar_url":"https://avatars2.githubusercontent.com/u/18060512?v=4","gravatar_id":"","url":"https://api.github.com/users/dkfitbit","html_url":"https://github.com/dkfitbit","followers_url":"https://api.github.com/users/dkfitbit/followers","following_url":"https://api.github.com/users/dkfitbit/following{/other_user}","gists_url":"https://api.github.com/users/dkfitbit/gists{/gist_id}","starred_url":"https://api.github.com/users/dkfitbit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dkfitbit/subscriptions","organizations_url":"https://api.github.com/users/dkfitbit/orgs","repos_url":"https://api.github.com/users/dkfitbit/repos","events_url":"https://api.github.com/users/dkfitbit/events{/privacy}","received_events_url":"https://api.github.com/users/dkfitbit/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-03-07T20:51:36Z","updated_at":"2018-04-29T14:11:54Z","closed_at":null,"author_association":"NONE","body":"# Setup\r\n\r\n```go\r\ncfg, _ := config.NewConfigFromString(\"...\")\r\ncc, _ := credentials.LoadCCache(\"/tmp/krb5cc_1000\")\r\nk5cli, _ := client.NewClientFromCCache(cc)\r\nk5cli.WithConfig(cfg)\r\n\r\nreq, _ := http.NewRequest(\"GET\", \"https://example.com/endpoint\", nil)\r\nk5cli.SetSPNEGOHeader(req, \"HTTP/example.com\")\r\n```\r\n\r\nKDC, kinit, and gokrb5 are all choosing aes256-cts-hmac-sha1-96 encryption (etype 18).\r\n\r\nTested against v2.1.2 and v4.1.1. Go version is go1.10 linux/amd64.\r\n\r\n# Expected behavior\r\n\r\nUses existing cached ticket for \"HTTP/example.com\" if one exists in ccache.\r\n\r\nUses TGT to obtain \"HTTP/example.com\" ticket if no existing ticket in ccache.\r\n\r\n# Actual behavior\r\n\r\nWorks fine if ccache contains TGT and nothing else.\r\n\r\nFails with following error when trying to use cached ticket:\r\n\r\n```\r\n[Root cause: Encoding_Error] Encoding_Error: cound not generate SPNEGO negotiation token: Could not create NegTokenInit: error getting MechToken; [Root cause: Encrypting_Error] KRBMessage_Handling_Error: Error creating Authenticator for AP_REQ < Encrypting_Error: Error encrypting Authenticator: Error encrypting data: Incorrect keysize: expected: 32 actual: 0\r\n```\r\n\r\nProximate cause is that encryptAuthenticator in messages/APReq.go has usage values defined for `nametype.KRB_NT_PRINCIPAL` and for `nametype.KRB_NT_SRV_INST`, but not for `nametype.KRB_NT_SRV_HST`. This causes usage to equal 0, which causes EncryptMessage in crypto/rfc3962/encryption.go to use a nil derived key.\r\n\r\nUnfortunately, I do not understand enough about the Kerberos protocol to propose an actual fix.\r\n\r\n## More details\r\n\r\nRunning `klist -ef` shows (with redactions):\r\n\r\n```\r\nTicket cache: FILE:/tmp/krb5cc_1000\r\nDefault principal: dking@CORP.REALM\r\n\r\nValid starting       Expires              Service principal\r\n03/07/2018 11:37:54  03/07/2018 21:37:54  krbtgt/CORP.REALM@CORP.REALM\r\n        renew until 03/08/2018 11:37:47, Flags: FPRIA\r\n        Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 \r\n03/07/2018 11:38:44  03/07/2018 21:37:54  krbtgt/PROD.REALM@CORP.REALM\r\n        renew until 03/08/2018 11:37:47, Flags: FPRAO\r\n        Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 \r\n03/07/2018 11:38:44  03/07/2018 21:37:54  HTTP/example.com@PROD.REALM\r\n        renew until 03/08/2018 11:37:47, Flags: FPRAT\r\n        Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 \r\n```\r\n\r\nCORP.REALM is a Windows AD DC, PROD.REALM is an MIT KDC (krb5-kdc on Ubuntu)."},"comment":{"url":"https://api.github.com/repos/jcmturner/gokrb5/issues/comments/385254403","html_url":"https://github.com/jcmturner/gokrb5/issues/99#issuecomment-385254403","issue_url":"https://api.github.com/repos/jcmturner/gokrb5/issues/99","id":385254403,"user":{"login":"jcmturner","id":10795321,"avatar_url":"https://avatars3.githubusercontent.com/u/10795321?v=4","gravatar_id":"","url":"https://api.github.com/users/jcmturner","html_url":"https://github.com/jcmturner","followers_url":"https://api.github.com/users/jcmturner/followers","following_url":"https://api.github.com/users/jcmturner/following{/other_user}","gists_url":"https://api.github.com/users/jcmturner/gists{/gist_id}","starred_url":"https://api.github.com/users/jcmturner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jcmturner/subscriptions","organizations_url":"https://api.github.com/users/jcmturner/orgs","repos_url":"https://api.github.com/users/jcmturner/repos","events_url":"https://api.github.com/users/jcmturner/events{/privacy}","received_events_url":"https://api.github.com/users/jcmturner/received_events","type":"User","site_admin":false},"created_at":"2018-04-29T14:11:54Z","updated_at":"2018-04-29T14:11:54Z","author_association":"OWNER","body":"I have written some tests to cover this but I am not getting the issue you are.\r\n\r\nThe tests written are:\r\nhttps://github.com/jcmturner/gokrb5/blob/bc57e566151da508625884ff2463482f98301fd5/client/client_integration_test.go#L557\r\nhttps://github.com/jcmturner/gokrb5/blob/bc57e566151da508625884ff2463482f98301fd5/client/client_integration_test.go#L593\r\n\r\nCan you check your setup again?\r\n\r\nThe only other thing I notice is that the realm of your target service is different to your client user. This may have something to do with it.\r\n\r\nGenerally I would recommend not having a dependency on the OS level cache and code a more native Go client."}}
{"actor":{"display_login":"jcmturner"}}