{"action":"created","issue":{"url":"https://api.github.com/repos/PowerShell/Win32-OpenSSH/issues/1295","repository_url":"https://api.github.com/repos/PowerShell/Win32-OpenSSH","labels_url":"https://api.github.com/repos/PowerShell/Win32-OpenSSH/issues/1295/labels{/name}","comments_url":"https://api.github.com/repos/PowerShell/Win32-OpenSSH/issues/1295/comments","events_url":"https://api.github.com/repos/PowerShell/Win32-OpenSSH/issues/1295/events","html_url":"https://github.com/PowerShell/Win32-OpenSSH/issues/1295","id":383050653,"node_id":"MDU6SXNzdWUzODMwNTA2NTM=","number":1295,"title":"Add support for GSSAPIAuthentication and GSSAPIDelegateCredentials via SSPI","user":{"login":"mgkuhn","id":4479402,"node_id":"MDQ6VXNlcjQ0Nzk0MDI=","avatar_url":"https://avatars2.githubusercontent.com/u/4479402?v=4","gravatar_id":"","url":"https://api.github.com/users/mgkuhn","html_url":"https://github.com/mgkuhn","followers_url":"https://api.github.com/users/mgkuhn/followers","following_url":"https://api.github.com/users/mgkuhn/following{/other_user}","gists_url":"https://api.github.com/users/mgkuhn/gists{/gist_id}","starred_url":"https://api.github.com/users/mgkuhn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mgkuhn/subscriptions","organizations_url":"https://api.github.com/users/mgkuhn/orgs","repos_url":"https://api.github.com/users/mgkuhn/repos","events_url":"https://api.github.com/users/mgkuhn/events{/privacy}","received_events_url":"https://api.github.com/users/mgkuhn/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-11-21T10:25:49Z","updated_at":"2018-12-03T03:31:22Z","closed_at":null,"author_association":"NONE","body":"Although GSSAPI authentication support was excluded from the [initial scope of the project](https://github.com/PowerShell/Win32-OpenSSH/wiki/Project-Scope), this remains a highly desireable feature. In domain-managed \"enterprise\" environments, where both clients and servers usually have already been issued cryptographic keys via Active Directory's Kerberos implementation, GSSAPI would enable secure password-free ssh logins without any need to manage public-key credentials for openssh.\r\n\r\nA particular priority would be support of GSSAPI authentication and ticket delegation in the sshd server. This is because client-side GSSAPI support exists already in two other forms:\r\n- the PuTTY ssh client has supported both GSSAPI authentication and delegation since version 0.61 (2011), via either Microsoft's SSPI or [MIT's Kerberos for Windows](http://web.mit.edu/kerberos/dist/);\r\n- the openssh ssh client reportedly can already be compiled with MIT's Kerberos for Windows GSSAPI implementation (although this is not currently done in the binary releases).\r\n\r\nHowever there is currently no freely available sshd server that can receive a delegated ticket and provide it to the logon session such that the user can then use it on the server to access there other Kerberos-authenticated resources, such as shares on a file server. MIT's Kerberos for Windows maintains its own ticket cache separate from those used by the Windows Local Security Authority (LSA). Therefore sshd will have to use Microsoft's SSPI interface in order to ensure that a password-free GSSAPI-authenticated login with ticket delegation will give via the LSA logon session access to all Kerberos-authenticated resources on the server.\r\n"},"comment":{"url":"https://api.github.com/repos/PowerShell/Win32-OpenSSH/issues/comments/443578776","html_url":"https://github.com/PowerShell/Win32-OpenSSH/issues/1295#issuecomment-443578776","issue_url":"https://api.github.com/repos/PowerShell/Win32-OpenSSH/issues/1295","id":443578776,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MzU3ODc3Ng==","user":{"login":"jborean93","id":8462645,"node_id":"MDQ6VXNlcjg0NjI2NDU=","avatar_url":"https://avatars3.githubusercontent.com/u/8462645?v=4","gravatar_id":"","url":"https://api.github.com/users/jborean93","html_url":"https://github.com/jborean93","followers_url":"https://api.github.com/users/jborean93/followers","following_url":"https://api.github.com/users/jborean93/following{/other_user}","gists_url":"https://api.github.com/users/jborean93/gists{/gist_id}","starred_url":"https://api.github.com/users/jborean93/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jborean93/subscriptions","organizations_url":"https://api.github.com/users/jborean93/orgs","repos_url":"https://api.github.com/users/jborean93/repos","events_url":"https://api.github.com/users/jborean93/events{/privacy}","received_events_url":"https://api.github.com/users/jborean93/received_events","type":"User","site_admin":false},"created_at":"2018-12-03T03:31:22Z","updated_at":"2018-12-03T03:31:22Z","author_association":"NONE","body":"@mgkuhn I'm not sure supporting kerb delegation will get 996 to start working. The issue with that one is due to the logon session type used with the initial logon and not the delegation of credentials."}}
{"actor":{"display_login":"jborean93"}}