Implement Cross-Platform Kerberos for .NET Core

[alexkeh]

Kerberos is a popular authentication protocol that many Windows .NET applications use. We would like .NET Core to add a cross-platform Kerberos implementation, including support for these MIT Kerberos APIs or equivalent functionality:

• krb5_init_context((krb5_context *)&context);
• krb5_sname_to_principal(context, (char *) 0, (char *) 0, KRB5_NT_SRV_HST, &server);
• krb5_get_default_realm(context, &therealm);
• krb5_cc_resolve(context, CCNm_, &ccache);
• krb5_cc_get_principal(context, ccache, &client);
• krb5_auth_con_init(context, &auth_context);
• krb5_copy_principal(context, server, &creds.server);
• krb5_copy_principal(context, client, &creds.client);
• krb5_get_credentials(context, 0, ccache, &creds, &credsp);
• krb5_mk_req_extended(context, &auth_context, auth_options, &cksum_data, credsp, &outbuf);

[karelz]

What are the user scenarios taking advantage of the APIs?
Do you have some API shape in mind?
How should it be integrated into existing networking APIs?

cc @wfurt @davidsh

[ScotMac]

Basically, we are acquiring client Kerberos credentials, then using them and server side credentials to acquire a TGT for the server DB service, and then generating the associated "authenticator" and sending it to the server. ie, pretty standard for authenticating to a service.

[ScotMac]

We would prefer that it is NOT integrated into any existing Network APIs, since that gives the API user more flexibility in terms of how to use or send the data to the server...which is the same as how MIT Kerberos5 APIs do it. Specifically, this is not at all associated with a web server or client.

[karelz]

So you are looking for general API for the protocol. Does anything prevent anyone from implementing it as separate library? Why does it need to be in CoreFX / .NET Core? Just convenience?
I assume there are similar APIs in Windows for Kerberos. Is that correct?

[jkotas]

https://github.com/SteveSyfuhs/Kerberos.NET ?

[filipnavara]

.NET already provides some high-level APIs that use Kerberos functionality internally, such as NegotiateStream. It may make sense to expose the low-level APIs in a platform independent way and layer the high level ones on top of them.

We already had to write platform specific versions of the code in order to support Kerberos authentication within the context of SASL authentication, which is in turn used by application protocols such as SMTP, IMAP or LDAP.

Unfortunately the high-level API already provided is not suitable for this use case since we are bound by another protocol standard, where the on-wire representation is different.

[karelz]

If there is room for reuse of APIs even inside .NET Core itself, then it would definitely make sense.
We would need someone familiar with those implementations to help design the right API surface - satisfying the consumer needs & making it reasonable for public consumption.

[ScotMac]

.NET already provides some high-level APIs that use Kerberos functionality internally, such as NegotiateStream. It may make sense to expose the low-level APIs in a platform independent way and layer the high level ones on top of them.

We already had to write platform specific versions of the code in order to support Kerberos authentication within the context of SASL authentication, which is in turn used by application protocols such as SMTP, IMAP or LDAP.

Unfortunately the high-level API already provided is not suitable for this use case since we are bound by another protocol standard, where the on-wire representation is different.

Yes, this is exactly the problem. The windows APIs and .NET APIs are within the context of very specific upper layer protocols, and often a windows domain instead of a generic KDC.

[ScotMac]

https://github.com/SteveSyfuhs/Kerberos.NET ?

Steve's package does no authenticator generation, only validation.

[ScotMac]

So you are looking for general API for the protocol. Does anything prevent anyone from implementing it as separate library? Why does it need to be in CoreFX / .NET Core? Just convenience?
I assume there are similar APIs in Windows for Kerberos. Is that correct?

Yes, it doesn't have to be in .NET/.NET Core. For example, if Steve's package could be extended to do the GENERATION of the authenticator, that would be a great first step.

But yes, it would be a lot "nicer" if it was included in .NET/.NET Core.

[SteveSyfuhs]

For what it's worth, the library has been extended to do generation (and issuance and what not).

[tornie2]

@SteveSyfuhs

Does that mean we can generate Kerberos tokens in .net Core now ?
I .net 4.8 we could do it with something like this:

        private string KerberosToken(Uri uri)
        {
            // Uri uri = new Uri(url);
            var serviceName = "HTTP/" + uri.Host + (uri.Port != 80 && uri.Port != 443 ? ":" + uri.Port : "");

            var tokenProvider = new KerberosSecurityTokenProvider(serviceName, TokenImpersonationLevel.Impersonation, CredentialCache.DefaultNetworkCredentials);
            var securityToken = tokenProvider.GetToken(TimeSpan.FromMinutes(1)) as KerberosRequestorSecurityToken;
            return Convert.ToBase64String(securityToken.GetRequest());
        }

[SteveSyfuhs]

That class is not available in Core AFAIK. It's also very Windows-specific. The library people are referring to above is 3rd party and is an implementation of the Kerberos protocol. It does not call into GSSAPI, which is probably not the most useful for corefx.

[karelz]

The APIs seem to be too low-level for us to take into the BCL. We think the APIs won't be used by too many people.
It sounds like a good candidate for independent package. Closing.