feat(sspi): add NT_ENTERPRISE support in server-side Kerberos (#535)

Adds `NT_ENTERPRISE` support in server-side Kerberos.
This is needed when want to connect using FQDN instead of down-level logon name.

Author: PavloMyroniuk-apriorit

src/kerberos/server/extractors.rs

@@ -3,15 +3,15 @@ use picky::oids;
 use picky_asn1::wrapper::ExplicitContextTag1;
 use picky_krb::constants::gss_api::{ACCEPT_COMPLETE, AP_REQ_TOKEN_ID};
 use picky_krb::constants::key_usages::{AP_REQ_AUTHENTICATOR, TICKET_REP};
-use picky_krb::constants::types::NT_PRINCIPAL;
+use picky_krb::constants::types::{NT_ENTERPRISE, NT_PRINCIPAL};
 use picky_krb::crypto::CipherSuite;
-use picky_krb::data_types::{Authenticator, EncTicketPart, PrincipalName};
+use picky_krb::data_types::{Authenticator, EncTicketPart, KerberosStringAsn1, PrincipalName};
 use picky_krb::gss_api::{
     ApplicationTag0, GssApiNegInit, KrbMessage, MechTypeList, NegTokenInit, NegTokenTarg, NegTokenTarg1,
 };
 use picky_krb::messages::{ApReq, TgtReq};
 
-use crate::{Error, ErrorKind, Result};
+use crate::{Error, ErrorKind, Result, Username};
 
 /// Extract TGT request and mech types from the first token returned by the Kerberos client.
 #[instrument(ret, level = "trace")]
@@ -170,17 +170,24 @@ pub(super) fn select_mech_type(mech_list: &MechTypeList) -> Result<ObjectIdentif
     ))
 }
 
-/// Extract username from the [PrincipalName].
-pub(super) fn extract_username(cname: &PrincipalName) -> Result<String> {
+/// Constructs [Username] from the client's [PrincipalName] and realm.
+pub(super) fn client_upn(cname: &PrincipalName, crealm: &KerberosStringAsn1) -> Result<Username> {
+    let username = cname
+        .name_string
+        .0
+         .0
+        .first()
+        .map(|name| name.to_string())
+        .ok_or_else(|| Error::new(ErrorKind::InvalidToken, "missing cname value in token"))?;
+
     let name_type = &cname.name_type.0 .0;
     if name_type == &[NT_PRINCIPAL] {
-        cname
-            .name_string
-            .0
-             .0
-            .first()
-            .map(|name| name.to_string())
-            .ok_or_else(|| Error::new(ErrorKind::InvalidToken, "missing cname value in token"))
+        Ok(Username::new_upn(
+            &username,
+            &crealm.0.to_string().to_ascii_lowercase(),
+        )?)
+    } else if name_type == &[NT_ENTERPRISE] {
+        Ok(Username::parse(&username)?)
     } else {
         Err(Error::new(
             ErrorKind::InvalidToken,

src/kerberos/server/mod.rs

@@ -7,7 +7,7 @@ use std::io::Write;
 use std::time::Duration;
 
 use cache::AuthenticatorCacheRecord;
-use extractors::{extract_client_mic_token, extract_username, select_mech_type};
+use extractors::{extract_client_mic_token, select_mech_type};
 use generators::{generate_mic_token, generate_tgt_rep};
 use picky::oids;
 use picky_asn1::restricted_string::IA5String;
@@ -30,6 +30,7 @@ use super::utils::validate_mic_token;
 use crate::builders::FilledAcceptSecurityContext;
 use crate::generator::YieldPointLocal;
 use crate::kerberos::flags::ApOptions;
+use crate::kerberos::server::extractors::client_upn;
 use crate::kerberos::DEFAULT_ENCRYPTION_TYPE;
 use crate::{
     AcceptSecurityContextResult, BufferType, CredentialsBuffers, Error, ErrorKind, Kerberos, KerberosState, Result,
@@ -288,10 +289,7 @@ pub async fn accept_security_context(
 
             debug!("ApReq Ticket and Authenticator are valid!");
 
-            server_data.client = Some(Username::new_upn(
-                &extract_username(&cname.0)?,
-                &crealm.0 .0.to_string().to_ascii_lowercase(),
-            )?);
+            server_data.client = Some(client_upn(&cname.0, &crealm.0)?);
 
             let ap_options_bytes = ap_req.0.ap_options.0 .0.as_bytes();
             // [5.5.1.  KRB_AP_REQ Definition](https://www.rfc-editor.org/rfc/rfc4120#section-5.5.1)