来自 SSPI 的 KRB_AP_REQ 票证
我有一个使用 Kerberos 进行客户端身份验证的 Linux 服务器应用程序和需要在 Windows 上运行的客户端。 Kerberos 票证由 Windows Active Directory 颁发。如果我使用 MIT KfW 3.2.2，客户端会在服务器上成功进行身份验证。用于从 Kerberos 服务器检索 AS 和 TGS 票证并将其存储在 kerberos 凭证存储中的 API。但这种方法的问题是用户需要再次输入他的凭据。 解决方案是访问 MS LSA 存储，但这不起作用。 ms2mit.exe 应用程序也没有。无论我以普通用户还是管理员身份运行它，或者完全禁用 UAC，都没有关系。 这就是为什么我想在客户端上使用 SSPI 来发送 KRB_AP_REQ 消息并将其发送到服务器。这可能吗。如果是的话怎么办？如果否，我还有哪些其他选择？请注意，服务器已经构建完毕，需要付出很大的努力才能更改它，因此我想在 Windows 上找到解决方案。
I have a Linux server application that is using Kerberos for client authentication and client that needs to run on Windows. Kerberos tickets are issued by Windows Active Directory. Client authenticates successfully on server if I use MIT KfW 3.2.2. API for retrieving AS and TGS tickets from Kerberos server and store them in kerberos credentials store. But the problem with this approach is that user needs to input his credentials again.
The solution would be to access MS LSA store but this does not work. Neither does ms2mit.exe application. It does not matter if I run it as normal user or as administrator, or if I disable UAC completely.
This is why I would like to use SSPI on client to make the KRB_AP_REQ message which I would send to server. Is that possible. If yes how can it be done? IF no, what are my other options? Please note that server is already built and it would require significant effort to change it, therefore I would like to find a solution on windows.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以使用 AquireCredentialsHandle 和 InitializeSecurityContext 函数可获取有效票证并对基于 Linux 的服务器进行身份验证。
首先使用
AcquireCredentialsHandle()，然后使用从服务器获取的令牌多次调用InitializeSecurityContext，直到通过身份验证。You can use the AquireCredentialsHandle and InitializeSecurityContext functions of the windows SSPI subsystem to get a valid ticket and authenticate against a Linux based server.
First use
AcquireCredentialsHandle()and than use multiple calls toInitializeSecurityContextwith the tokens you get from your server until your authenticated.