Comments (3)
Hi, You are in the guts of the library here. If you are just using one of the etypes implemented you shouldn't need to worry too much about these inner workings. However I will try to answer your bullet points:
- protocolKey: this is the key obtained directly from the keytab or the sessionkey. From this the actual encryption key is derived using a method specific to the etype that also takes in the usage number.
- What the data is depends on what you are trying to achieve. Not sure I have enough to answer this one.
- usage: these are the usage constants as defined in RFC 4210 you'll find them all at https://github.com/jcmturner/gokrb5/blob/master/iana/keyusage/constants.go
I'm afraid if you are going to operate at this level you'll need to get very familiar with the kerberos RFCs.
You can see how I have created an encrypted authenticator here:
https://github.com/jcmturner/gokrb5/blob/master/messages/APReq.go#L66 which uses the crypto.GetEncryptedData method.
from gokrb5.
@jcmturner thank you for the answer.
Actually I was just following README and stuck on checksum calculation - https://github.com/jcmturner/gokrb5/blob/master/README.md#generic-kerberos-client.
My general goal - authenticate against Kafka Brokers with SASL and GSSAPI described here https://kafka.apache.org/protocol#sasl_handshake. As you see, not really much information about authentication.
from gokrb5.
gokrb5 doesn't currently implement SASL but does have some implementation of GSSAPI, that was needed to support SPNEGO, which may be of use to you.
I think what's needed is to implement some of these RFCs
https://tools.ietf.org/html/rfc4752#section-3.1
https://tools.ietf.org/html/rfc4422
from gokrb5.
Related Issues (20)
- is POST supported or just GET? HOT 1
- How can I get a kvno for keytab, by a separate request, or in another way? HOT 1
- Getting valid service KVNO HOT 2
- dns_canonicalize_hostname is not always a boolean value
- [bug]: out of range
- Principal name parsing does not handle backslash escapes/quoting HOT 1
- LoadCCache does not check file length
- Encryption Type Parsing of krb5.conf - Case Sensitive
- Go 1.20.x: Inconsistent LookupCNAME breaks TGS Exchange (KDC_ERR_S_PRINCIPAL_UNKNOWN)
- Use of hard-coded security token reported by a static analysis tool
- Decrypting ticket on initiator/client side
- Correctly-working redirects being interpreted as redirect loops in SPNEGO HTTP client.
- client login using keytab file
- Creating a keytabFile for FreeIPA HOT 2
- KVN is always 0 HOT 2
- No way to change context flags for SPNEGO's AP REQ
- Unable to pass authentication HOT 2
- Should `DNSLookupKDC` default to `true` to match `man krb5.conf` ? HOT 2
- SPNEGO validation error: defective token detected: PAC Info Buffers does not contain a KerbValidationInfo HOT 2
- Enhancement proposal: support dialer for TCP
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gokrb5.