feat(kerberos): add support for IAKerb extension for Kerberos client (#751)

This PR adds support for the IAKERB extension according to the [IAKERB
specification](https://datatracker.ietf.org/doc/html/draft-ietf-kitten-iakerb-03).

The main changes are focused on the `Kerberos` state machine.
Previously, the `Preauthentication` state handled the entire KDC message
exchange withing a single async `intialize_security_context` call. This
approach does not work with IAKERB, where KDC messages are exchanged via
a server that acts as a proxy. The `Preauthentication` state has
therefore been split into multiple states, allowing the state machine to
save `Kerberos` state between KDC message exchanges.

Additionaly, the `AS` and `TGS` exchanges have been extracted into
separate state machines. These new state machines are KDC
transport-agnostic and can be used with both external KDC and an IAKERB
proxy.

## What is IAKERB
IAKERB extends Kerberos to support scenarios where the client cannot
directly access the KDC. Instead, KDC messages are encapsulated in
GSS-API tokens and exchanged through an IAKERB proxy. The server
forwards these messages to the LocalKDC, allowing the client to obtain
the required Kerberos tickets without direct network access to the KDC.

Microsoft recently introduced IAKERB support in Windows Insider builds
as part of its effort to reduce NTLM dependency:
https://techcommunity.microsoft.com/blog/windows-itpro-blog/reducing-ntlm-dependency-iakerb-and-localkdc-in-windows-insider-preview/4524615.

## Related PRs
* picky-rs: Devolutions/picky-rs#531
* IronRDP: Devolutions/IronRDP#1987

Author: Rostyslav-Romanets

Cargo.lock

@@ -115,7 +115,7 @@ rand = "0.10"
 rand_core = "0.10"
 getrandom = "0.3"
 cfg-if = "1"
-picky = { version = "=7.0.0-rc.26", default-features = false }
+picky = { version = "=7.0.0-rc.27", default-features = false }
 sha1 = { version = "0.11", default-features = false }
 sha2 = "0.11"
 num-derive = "0.5"
@@ -180,7 +180,7 @@ pkcs1 = "=0.8.0-rc.4"
 base64 = "0.23"
 static_assertions = "1"
 whoami = "2.1"
-picky = { version = "=7.0.0-rc.26", default-features = false, features = ["x509"] }
+picky = { version = "=7.0.0-rc.27", default-features = false, features = ["x509"] }
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 proptest = "1.6"
 cfg-if = "1"

Cargo.toml

@@ -16,7 +16,7 @@ use std::rc::Rc;
 
 use anyhow::Context;
 use dpapi::{CryptProtectSecretArgs, CryptUnprotectSecretArgs};
-use sspi::KerberosConfig;
+use sspi::{KdcResolution, KerberosConfig};
 use url::Url;
 use wasm_bindgen::prelude::*;
 
@@ -169,7 +169,7 @@ impl DpapiConfig {
         let kerberos_config = Url::parse(kdc_proxy_url.unwrap_or_default().as_str())
             .ok()
             .map(|url| KerberosConfig {
-                kdc_url: Some(url),
+                kdc_resolution: KdcResolution::KdcUrl(Some(url)),
                 client_computer_name: computer_name.clone(),
             });
 

crates/dpapi-web/src/lib.rs

@@ -19,7 +19,7 @@ name = "winscard"
 bitflags = "2.11"
 iso7816 = "0.1"
 iso7816-tlv = "0.4"
-picky = { version = "=7.0.0-rc.26", default-features = false, features = ["x509"] }
+picky = { version = "=7.0.0-rc.27", default-features = false, features = ["x509"] }
 picky-asn1-x509 = "0.15"
 tracing = { version = "0.1", default-features = false, features = ["attributes"] }
 time = { version = "0.3", default-features = false, features = [

crates/winscard/Cargo.toml

@@ -26,7 +26,7 @@ fn main() -> Result<(), Box<dyn Error + Send + Sync>> {
         .with(EnvFilter::from_env("SSPI_LOG_LEVEL"))
         .init();
 
-    let kerberos_config = KerberosConfig::new(&kdc_url, hostname.clone());
+    let kerberos_config = KerberosConfig::new_with_kdc_url(&kdc_url, hostname.clone());
     let mut kerberos = Kerberos::new_client_from_config(kerberos_config).unwrap();
 
     let mut acq_creds_handle_result = get_cred_handle(&mut kerberos, username, password);

examples/kerberos.rs

@@ -29,7 +29,7 @@ sha1 = { version = "0.11", default-features = false }
 sha2 = "0.11"
 ffi-types = { workspace = true, features = ["sspi"] }
 
-picky = { version = "=7.0.0-rc.26", default-features = false, features = ["x509"], optional = true }
+picky = { version = "=7.0.0-rc.27", default-features = false, features = ["x509"], optional = true }
 picky-asn1-der = "0.5"
 picky-asn1 = { version = "0.10", optional = true }
 picky-asn1-x509 = { version = "0.15", optional = true }

ffi/Cargo.toml

@@ -20,8 +20,8 @@ use sspi::kerberos::config::KerberosConfig;
 use sspi::ntlm::NtlmConfig;
 use sspi::{
     CertContext, ClientRequestFlags, ConnectionInfo, Credentials, CredentialsBuffers, DataRepresentation, Error,
-    ErrorKind, Kerberos, Negotiate, NegotiateConfig, Ntlm, PackageInfo, Result, Secret, Sspi, SspiImpl, StreamSizes,
-    U16CString, Utf16String, Utf16StringExt, kerberos, negotiate, ntlm, pku2u,
+    ErrorKind, KdcResolution, Kerberos, Negotiate, NegotiateConfig, Ntlm, PackageInfo, Result, Secret, Sspi, SspiImpl,
+    StreamSizes, U16CString, Utf16String, Utf16StringExt, kerberos, negotiate, ntlm, pku2u,
 };
 #[cfg(target_os = "windows")]
 use windows::Win32::Security::Cryptography::{
@@ -438,7 +438,7 @@ fn create_negotiate_context(attributes: &CredentialsAttributes) -> Result<Negoti
     let client_computer_name = attributes.hostname()?;
 
     let negotiate_config = if let Some(kdc_url) = attributes.kdc_url() {
-        let kerberos_config = KerberosConfig::new(&kdc_url, client_computer_name.clone());
+        let kerberos_config = KerberosConfig::new_with_kdc_url(&kdc_url, client_computer_name.clone());
 
         NegotiateConfig::new(
             Box::new(kerberos_config),
@@ -505,14 +505,14 @@ pub(crate) unsafe fn p_ctxt_handle_to_sspi_context(
                 let client_computer_name = attributes.hostname()?;
 
                 if let Some(kdc_url) = attributes.kdc_url() {
-                    SspiContext::Kerberos(Kerberos::new_client_from_config(KerberosConfig::new(
+                    SspiContext::Kerberos(Kerberos::new_client_from_config(KerberosConfig::new_with_kdc_url(
                         &kdc_url,
                         client_computer_name,
                     ))?)
                 } else {
                     let krb_config = KerberosConfig {
                         client_computer_name,
-                        kdc_url: None,
+                        kdc_resolution: KdcResolution::KdcUrl(None),
                     };
                     SspiContext::Kerberos(Kerberos::new_client_from_config(krb_config)?)
                 }
@@ -1778,9 +1778,9 @@ pub unsafe extern "system" fn ChangeAccountPasswordA(
                 SspiContext::Negotiate(try_execute!(Negotiate::new_client(negotiate_config)))
             },
             kerberos::PKG_NAME => {
-                let krb_config = KerberosConfig{
+                let krb_config = KerberosConfig {
                     client_computer_name: try_execute!(hostname()),
-                    kdc_url:None
+                    kdc_resolution: KdcResolution::KdcUrl(None),
                 };
                 SspiContext::Kerberos(try_execute!(Kerberos::new_client_from_config(
                     krb_config

ffi/src/sspi/sec_handle.rs

@@ -746,6 +746,15 @@ impl CredentialsBuffers {
             _ => None,
         }
     }
+
+    pub fn extract_password(&self) -> Secret<String> {
+        Secret::new(match self {
+            CredentialsBuffers::AuthIdentity(auth_identity) => auth_identity.password.as_ref().as_ref().to_string(),
+            #[cfg(feature = "scard")]
+            CredentialsBuffers::SmartCard(smart_card) => smart_card.pin.as_ref().as_ref().to_string(),
+            CredentialsBuffers::Keytab(_keytab) => String::new(),
+        })
+    }
 }
 
 /// Generic enum that encapsulates credentials for any type of authentication

src/auth_identity.rs

@@ -15,7 +15,7 @@ use crate::kerberos::client::generators::{
 use crate::kerberos::client::principal::{get_client_principal_name_type, get_client_principal_realm};
 use crate::kerberos::pa_datas::AsReqPaDataOptions;
 use crate::kerberos::utils::serialize_message;
-use crate::kerberos::{CHANGE_PASSWORD_SERVICE_NAME, DEFAULT_ENCRYPTION_TYPE, KADMIN, client};
+use crate::kerberos::{CHANGE_PASSWORD_SERVICE_NAME, DEFAULT_ENCRYPTION_TYPE, KADMIN, server};
 use crate::utils::generate_random_symmetric_key;
 use crate::{ClientRequestFlags, Error, ErrorKind, Kerberos, Result};
 
@@ -29,6 +29,13 @@ pub async fn change_password<'a>(
     yield_point: &mut YieldPointLocal,
     change_password: ChangePassword<'a>,
 ) -> Result<()> {
+    if client.is_iakerb() {
+        return Err(Error::new(
+            ErrorKind::UnsupportedFunction,
+            "changing password is not supported with IAKerb.",
+        ));
+    }
+
     let username = &change_password.account_name;
     let domain = &change_password.domain_name;
     let password = &change_password.old_password;
@@ -59,7 +66,7 @@ pub async fn change_password<'a>(
         with_pre_auth: false,
     });
 
-    let as_rep = client::as_exchange(client, yield_point, &kdc_req_body, pa_data_options).await?;
+    let as_rep = server::as_exchange::as_exchange(client, yield_point, &kdc_req_body, pa_data_options).await?;
 
     debug!("AS exchange finished successfully.");