Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

Almost nothing in Perl serves a single purpose. -- Larry Wall in <199712040054.QAA13811@wall.org>


devel / comp.protocols.kerberos / Re: Kerberos token

SubjectAuthor
o Re: Kerberos tokenKen Hornstein

1
Re: Kerberos token

<mailman.77.1711135652.2322.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=529&group=comp.protocols.kerberos#529

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!usenet.blueworldhosting.com!diablo1.usenet.blueworldhosting.com!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: ken...@cmf.nrl.navy.mil (Ken Hornstein)
Newsgroups: comp.protocols.kerberos
Subject: Re: Kerberos token
Date: Fri, 22 Mar 2024 15:27:23 -0400
Organization: TNet Consulting
Lines: 20
Message-ID: <mailman.77.1711135652.2322.kerberos@mit.edu>
References: <628253825.301474.1711129798132.ref@mail.yahoo.com>
<628253825.301474.1711129798132@mail.yahoo.com>
<202403221927.42MJRNx0002777@hedwig.cmf.nrl.navy.mil>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="9712"; mail-complaints-to="newsmaster@tnetconsulting.net"
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
To: "m_a_n_j_u_s_k@yahoo.com" <m_a_n_j_u_s_k@yahoo.com>
DKIM-Filter: OpenDKIM Filter v2.11.0 unknown-host (unknown-jobid)
Authentication-Results: mailman.mit.edu;
dkim=pass (1024-bit key, unprotected) header.d=mitprod.onmicrosoft.com
header.i=@mitprod.onmicrosoft.com header.a=rsa-sha256
header.s=selector2-mitprod-onmicrosoft-com header.b=D1xXNP1E;
dkim=pass (2048-bit key,
unprotected) header.d=nrl.navy.mil header.i=@nrl.navy.mil header.a=rsa-sha256
header.s=s2.dkim header.b=eTTPSU8c
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=BK7AtvSSebM9wPA1gooJPWOAx9lMv/4S8Fh7YaMPWYc4GdtkhsCWFWg4z/cYn9zth1VYVLiIFzE+VB7dU2d4s3J19lRxpO0JOBv9JnM+IQSSMPpVg4QruSsJYL6o5FrochYD3fNk90gNUJODa+p3YAgKDUamh/dT/KsckTvHrxI5OVCRoZsx6ihrcPGKR5EYmom+PD83ceVfSPDS3GVsJVZb7tDtHMTq99QJO9caJM4e9asn+IPyI4L7w1EDejQZRe3whLhOesu6X8XPqZhp0OC9R9EB17Vnl2axwZaH+27mEbln4pn3ALi6p92qS83w9LrvR7B0tXmLTjMkmrHVzw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=1/N5lFG9OOERIFiVsJhGJ8rXzwI6A4kr8sm8i0fY7To=;
b=KP7K6GpY0zJJylNUZ10lzjZKvYvb8MELE80KM0xKwq7p4IdSFdqBT4tDqlERbQCOo67/j8G3rjRIHkF32Yon5M/ZxiiQiCr5si/1uD1NYYfY+cKE90DBR6NnsMxy9wcY3rbfYBgKJTkf6D8PZt2KLsIOTApR2+LkpyuWf1O2FEwpz1e42Apj53YO/f6pbqE1p3HmVn+LsbAv5T5aw/EVxleAasn6lgZPkv1cZYqCx5J2TBl4cDW9giCuBuBvaFKX7MM1LSCUrK4EoLOPlC4PAdRjQ/xQmF2PW0spTYp3DsHgyNoBo2ImqoNtVwmQQqyVZkj+0Nm2QQz8jX5gas9XwA==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is
140.32.61.234) smtp.rcpttodomain=mit.edu smtp.mailfrom=cmf.nrl.navy.mil;
dmarc=pass (p=reject sp=reject pct=100) action=none
header.from=cmf.nrl.navy.mil; dkim=pass (signature was verified)
header.d=nrl.navy.mil; arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=1/N5lFG9OOERIFiVsJhGJ8rXzwI6A4kr8sm8i0fY7To=;
b=D1xXNP1EQdCDrqBurh8gRPmFWsu2vxffAJFg0WSeZ2FFWzwyobcCD0rOlCq8cLfndQ1PaFpzV3z04dbWR/PNal8V04D6kBaTbfZzJU+YIYh9371pYxOawEP9IvR7v1a4r7aQEwTqtoE3fKHQXURcPVhLtjhJ/EsUXpqKeUOfetI=
Authentication-Results: spf=pass (sender IP is 140.32.61.234)
smtp.mailfrom=cmf.nrl.navy.mil; dkim=pass (signature was verified)
header.d=nrl.navy.mil;dmarc=pass action=none header.from=cmf.nrl.navy.mil;
Received-SPF: Pass (protection.outlook.com: domain of cmf.nrl.navy.mil
designates 140.32.61.234 as permitted sender)
receiver=protection.outlook.com; client-ip=140.32.61.234; helo=mf.dren.mil;
pr=C
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nrl.navy.mil;
h=message-id : from :
to : cc : subject : in-reply-to : references : mime-version : content-type
: content-transfer-encoding : date; s=s2.dkim;
bh=1/N5lFG9OOERIFiVsJhGJ8rXzwI6A4kr8sm8i0fY7To=;
b=eTTPSU8clEe1+1GSzho7CvHfCB+PCpaJJqyj20MBYxmSjlhqIc/2THaC6HsqgXDrfmpJ
f+VDDvE1zpnImgL6xY/D6am0kk/DQwcV/nicWv4pvcMv0eMYPRl2YU5vWJDiriQqlcoU
RhXZoosKNkdvUu6qOLXwLimatSRl9ZPnNWa7KvDXhuH9UvQE/w+B2tg8bcPmhalbNBDq
cizYKRnrl9YeW3/FIciQwVdN++rnLtCsl7hvFMlLmVtVLX4WZ9mk4bNhlEcfTLCkVb5Y
wzJOZfraf7YRyRz/CSetAGkX9Ta+cyPNb97qxgzmhQ6UR7/Qf8UzPvj2LaJE++Gqkd8F Jg==
In-Reply-To: <628253825.301474.1711129798132@mail.yahoo.com>
X-Face: "Evs"_GpJ]],xS)b$T2#V&{KfP_i2`TlPrY$Iv9+TQ!6+`~+l)#7I)0xr1>4hfd{#0B4
WIn3jU;bql;{2Uq%zw5bF4?%F&&j8@KaT?#vBGk}u07<+6/`.F-3_GA@6Bq5gN9\+s;_d
gD\SW #]iN_U0 KUmOR.P<|um5yP<ea#^"SJK;C*}fMI;Mv(aiO2z~9n.w?@\>kEpSD@*e`
X-NRLCMF-Spam-Score: () hits=0 User Authenticated
X-NRLCMF-Virus-Scanned:
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: CH2PEPF0000009D:EE_|SA3PR01MB8450:EE_
X-MS-Office365-Filtering-Correlation-Id: 1f18aeb5-09ce-4857-d90c-08dc4aa61be4
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: 1EB8spl5vZhlnvwaTChsGLhV6dU3QLOkP3bkSxfUisKOEtImtO9rb69tmBXAUfPW6iLeU4jE918gCHfS/mEDt7Z+4Exuk3Tb5hROsPXyJjJ7SN8Sn+yAT8FsnSsAnOZs2QuWSL5iXmzGhVicgsFPZoiGHPmiPwp2pN2r8feYrZa5HrSvxZ1QS4TxBS9LtI1a1bp+9+5+YceOzxRBq99kjDzSJsH0BE/P0ugMNS7pw/xzaR//D1SuLdCKjJAejsZkJhbQhs8C/ATfmX/oJPoi4GmxwfaAg2OLn8rM78snuorhXG9Ue2YDOeaj2vhnRePMR0irs4dVz+2hvq3QuwacBCEAbLpgvwKWYDxbsoXIPx/0WvC78iA80cS+4EZWNoI5687gDJQ0JvYfhiVG37rr86lLsTEFnXK+UjR1PDvmcNmOUgDEsJbHJ36RHvFrZAaiHK3OW9JlXcBIuMbHvwJnxO9cirQRB/9DjXsyTISc6A4VsFdkyhbrETr6Yv/i8FbbIJOb5vw1COFlj9+ef1Flp24xI0MN7Eqe6Ph/KUPRR25TMxFzu3syj1rAlLGPdVrNEJsxXAYypCt0HGHTApz1NKP14bbe0l8FS73pwjcYcXONoDlV92xuRG3taL2unVYgYmUC/cHFQ8VpXdtyZeEcuwygt2ZXidDZX4bmdXjUIb3+8seT57JCqZQY8dEM3RkNirgx4w3+sJijt7WY1G49qxgiMvHKD66kn6jszROEpH858EakwCs72UH9Aogxuo7L
X-Forefront-Antispam-Report: CIP:140.32.61.234; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:mf.dren.mil; PTR:mfw.dren.mil; CAT:NONE;
SFS:(13230031)(376005)(48200799009)(61400799018); DIR:OUT; SFP:1102;
X-ExternalRecipientOutboundConnectors: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-OriginatorOrg: mitprod.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Mar 2024 19:27:27.0745 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 1f18aeb5-09ce-4857-d90c-08dc4aa61be4
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: CH2PEPF0000009D.namprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA3PR01MB8450
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <202403221927.42MJRNx0002777@hedwig.cmf.nrl.navy.mil>
X-Mailman-Original-References: <628253825.301474.1711129798132.ref@mail.yahoo.com>
<628253825.301474.1711129798132@mail.yahoo.com>
 by: Ken Hornstein - Fri, 22 Mar 2024 19:27 UTC

>Hi, I have an application that authenticates against a Proxy server
>which user Kerberos authentication scheme. My application is using SSPI
>library (github/alexbrainman/sspiĀ Golang package to be exact) generate
>a kerberos token and this token is passed to the Proxy server through
>Proxy-Authorization header "Proxy-Authorization: Negotiate <kerberos
>token>" My query, for the subsequent calls to the proxy do I need to
>regenerate this key or can I reuse the one generated the first time ?
>Or is it that each call to the proxy is treated as a session and that
>Kerberos token is for that session only ?

As a general rule, GSSAPI tokens (which in the specific case of Kerberos
contain AP-REQ/AP-REP messages) are supposed to be only used once;
they contain an expiration time in them and are supposed to be checked
for reuse on the server side (although that may not always happen
depending on implementation details). You should always get a new
one by calling the appropriate APIs. Note that assuming your client
is using a standard ticket cache only the first request will require
contacting the KDC.

--Ken

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor