[Rostyslav-Romanets]

This PR adds support for the IAKERB extension according to the IAKERB specification.

The main changes are focused on the Kerberos state machine. Previously, the Preauthentication state handled the entire KDC message exchange withing a single async intialize_security_context call. This approach does not work with IAKERB, where KDC messages are exchanged via a server that acts as a proxy. The Preauthentication state has therefore been split into multiple states, allowing the state machine to save Kerberos state between KDC message exchanges.

Additionaly, the AS and TGS exchanges have been extracted into separate state machines. These new state machines are KDC transport-agnostic and can be used with both external KDC and an IAKERB proxy.

What is IAKERB

IAKERB extends Kerberos to support scenarios where the client cannot directly access the KDC. Instead, KDC messages are encapsulated in GSS-API tokens and exchanged through an IAKERB proxy. The server forwards these messages to the LocalKDC, allowing the client to obtain the required Kerberos tickets without direct network access to the KDC.

Microsoft recently introduced IAKERB support in Windows Insider builds as part of its effort to reduce NTLM dependency: https://techcommunity.microsoft.com/blog/windows-itpro-blog/reducing-ntlm-dependency-iakerb-and-localkdc-in-windows-insider-preview/4524615.

Related PRs

• picky-rs: feat(picky-krb): add IAKerb proxy message encoding/decoding picky-rs#531
• IronRDP: feat(credssp): use the KdcResolution enum instead of KDC url IronRDP#1987

[Rostyslav-Romanets]

These patches of picky-rs can be removed once a new version containing the following changes will be released: (Devolutions/picky-rs#531) will be released.

[Rostyslav-Romanets]

I disabled the MIC token verification due to this issue: #748

[Copilot]

Copilot review overview

🟡 Changes recommended

Dependency resolution, workspace compilation, cross-realm transitions, state preservation, mechanism framing, and SPNEGO MIC verification contain blocking issues.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 4 · 2

Open (6)

• CI fails because required sibling picky-rs checkout is unavailable · New
• Referral processing repeats TGS response instead of requesting next realm · New
• Removing kdc_url breaks dpapi-web KerberosConfig initialization · New
• Server mechListMIC is accepted without signature verification · New
• Fallible state transition corrupts context on error · New
• IAKERB final AP-REQ uses incorrect Kerberos mechanism OID · New

What changed in this PR

Adds IAKERB proxy support to Kerberos authentication and restructures AS/TGS exchanges into resumable state machines.

Changes:

• Adds IAKERB configuration, framing, cookies, transcript checksums, and SPNEGO negotiation.
• Splits Kerberos client/server exchange states and secures DH private keys.
• Updates callers, tests, FFI, and picky dependencies.

File	Description
tests/​sspi/​client_server/​kerberos/​mod.rs	Updates Kerberos configurations and exchange counts.
tests/​sspi/​client_server/​credssp.rs	Updates configuration and CredSSP step count.
src/​utils.rs	Maps IAKERB proxy errors.
src/​pku2u/​server.rs	Wraps DH private keys as secrets.
src/​pku2u/​mod.rs	Reads secret DH keys.
src/​pku2u/​generators.rs	Generates secret DH keys.
src/​pk_init.rs	Secures DH parameters.
src/​negotiate/​server.rs	Adjusts final MIC handling.
src/​negotiate/​mod.rs	Adds IAKERB mechanism selection.
src/​negotiate/​generators.rs	Advertises the IAKERB mechanism.
src/​negotiate/​client.rs	Integrates IAKERB and MIC exchange behavior.
src/​lib.rs	Exports KDC resolution configuration.
src/​kerberos/​tests.rs	Updates test contexts for new state fields.
src/​kerberos/​server/​mod.rs	Introduces server-specific states.
src/​kerberos/​server/​as_exchange.rs	Hosts transport-based AS exchange logic.
src/​kerberos/​pa_datas.rs	Reads protected DH keys.
src/​kerberos/​mod.rs	Adds split states and IAKERB context data.
src/​kerberos/​messages.rs	Encodes IAKERB proxy messages.
src/​kerberos/​config.rs	Adds KDC resolution strategies.
src/​kerberos/​client/​mod.rs	Implements resumable Kerberos client exchanges.
src/​kerberos/​client/​kdc/​tgs_exchange.rs	Adds the TGS exchange state machine.
src/​kerberos/​client/​kdc/​mod.rs	Decodes direct and proxied KDC replies.
src/​kerberos/​client/​kdc/​as_exchange.rs	Adds the AS exchange state machine.
src/​kerberos/​client/​generators.rs	Serializes authenticator extensions.
src/​kerberos/​client/​extractors.rs	Validates preauthentication errors.
src/​kerberos/​client/​change_password.rs	Rejects IAKERB password changes.
src/​kerberos/​client/​as_exchange.rs	Removes the previous AS exchange implementation.
src/​auth_identity.rs	Adds protected password extraction.
ffi/​src/​sspi/​sec_handle.rs	Migrates FFI configuration construction.
examples/​kerberos.rs	Updates the Kerberos example constructor.
Cargo.toml	Adds local picky dependency patches.
Cargo.lock	Records locally patched picky packages.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Rostyslav-Romanets]

Fixed

[Marc-André Moreau (mamoreau-devolutions)]

Requesting changes for the three blocking issues already documented in open inline threads (avoiding duplicate comments): the sibling-only picky dependency patches prevent a clean checkout from building (#751 (comment)); cross-realm referrals never transition back to TgsRequest (#751 (comment)); and the client accepts the server mechListMIC without verification for every SPNEGO mechanism (#751 (comment)). I reproduced the dependency failure with cargo check --locked --offline -p sspi. Please resolve these before merging.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot review overview

🟡 Changes recommended

The IAKERB Finished checksum currently uses the wrong key usage and byte order, preventing interoperable authentication.

Review effort: Balanced
Findings: 5

Open (5)

• Encode authenticator extension fields in big-endian order · New
• Use IAKERB key usage 42 for Finished checksum · New
• Zeroize generated DH private key immediately · New
• Server mechListMIC is accepted without signature verification
• Removing kdc_url breaks dpapi-web KerberosConfig initialization

Resolved since last review (4)

• Referral processing repeats TGS response instead of requesting next realm
• CI fails because required sibling picky-rs checkout is unavailable
• IAKERB final AP-REQ uses incorrect Kerberos mechanism OID
• Fallible state transition corrupts context on error

Previously missed (1)

In code that hasn't changed since last review

Map IAKERB availability failures to NoAuthenticatingAuthority

src/​utils.rs:217

Both errors mean the proxy could not reach a KDC, but mapping them to KdcInvalidRequest prevents Negotiate's documented NTLM fallback, which only handles such network/proxy failures as NoAuthenticatingAuthority (src/negotiate/client.rs:17-30). Map both IAKERB availability errors accordingly so authentication can fall back when NTLM is enabled.

[Copilot]

Copilot review overview

🟡 Changes recommended

Direct IAKERB contexts can incorrectly initiate U2U, proxy availability errors prevent fallback, and the new exchange lacks end-to-end coverage.

Review effort: Balanced
Findings: 4

Open (4)

• Normalize IAKERB flags in the Kerberos implementation · New
• Use IAKERB key usage 42 for Finished checksum
• Server mechListMIC is accepted without signature verification
• Removing kdc_url breaks dpapi-web KerberosConfig initialization

Resolved since last review (2)

• Zeroize generated DH private key immediately
• Encode authenticator extension fields in big-endian order

Previously missed (4)

In code that hasn't changed since last review

Classify proxy availability failures as NoAuthenticatingAuthority

src/​utils.rs:217

Both proxy availability failures are classified as KdcInvalidRequest, so Negotiate will not take its documented network/proxy-error fallback path, which only recognizes NoAuthenticatingAuthority (src/negotiate/client.rs:17-30). These codes mean the proxy could not locate or contact a KDC, not that the client request was invalid; classify them as NoAuthenticatingAuthority so callers receive the correct SSPI status and configured NTLM fallback remains functional.

Add end-to-end multi-call IAKERB state-machine coverage

src/​kerberos/​client/​mod.rs:276

The new multi-call IAKERB branch has no end-to-end state-machine test; the added test only exercises decode_kdc_reply. Add a mocked AS-error/AS-reply/TGS-reply exchange that checks each ContinueNeeded proxy token, cookie forwarding, transcript accumulation, and the final AP request so regressions in the core feature are detected.

Report the actual invalid server state in diagnostics

src/​kerberos/​client/​mod.rs:697

Because mem::take has already installed the default Failed state, this error always says the context was in Failed rather than identifying the actual Final or Server state that caused the out-of-sequence call. Bind and report the consumed state instead.

Report the actual invalid client state in diagnostics

src/​kerberos/​server/​mod.rs:171

mem::take has already replaced server.state with Failed, so this diagnostic always reports Failed instead of the actual invalid Client or Final state. Bind the matched value and format it directly to preserve an actionable out-of-sequence error.

[Benoît Cortier (CBenoit)]

Hi Rostyslav-Romanets

The new picky crates are now published 🙂

[Benoît Cortier (CBenoit)]

Copilot also still have a few "High" findings, did you confirm whether it was false positives or fixed?

[Rostyslav-Romanets]

Benoît Cortier (@CBenoit)

Copilot also still have a few "High" findings, did you confirm whether it was false positives or fixed?

I have fixed all issues found by Copilot. Some findings are false positive, I explained why in comments.
Also I have rebased this branch on the latest master branch.

[Copilot]

Copilot review overview

🟡 Changes recommended

Remaining configuration compile errors, lost TGS clock correction, and an incomplete SPNEGO state transition must be fixed.

Review effort: Balanced
Findings: 3 · 2

Open (5)

• Migrate remaining tests from removed kdc_url field · New
• Server mechListMIC is accepted without signature verification
• Removing kdc_url breaks dpapi-web KerberosConfig initialization
• Use adjusted KDC time for TGS authenticator timestamps · New
• Transition to Ok after completing MIC exchange · New

Resolved since last review (2)

• Normalize IAKERB flags in the Kerberos implementation
• Use IAKERB key usage 42 for Finished checksum

[Rostyslav-Romanets]

Fixed

[Copilot]

Copilot review overview

🟡 Changes recommended

IAKERB KDC failures bypass established NTLM fallback, and the primary multi-step IAKERB flow lacks authentication coverage.

Review effort: Balanced
Findings: 3 · 1

Open (4)

• Migrate remaining tests from removed kdc_url field
• Server mechListMIC is accepted without signature verification
• Removing kdc_url breaks dpapi-web KerberosConfig initialization
• Add integration coverage for the IAKERB authentication flow · New

Resolved since last review (2)

• Transition to Ok after completing MIC exchange
• Use adjusted KDC time for TGS authenticator timestamps

Previously missed (1)

In code that hasn't changed since last review

Map KdcInvalidRequest to NTLM fallback errors

src/​utils.rs:217

These two errors describe KDC unavailability, but KdcInvalidRequest is not in NTLM_FALLBACK_ERROR_KINDS. As a result, Negotiate configured for IAKERB aborts instead of following the existing fallback behavior for an unreachable/missing KDC (src/negotiate/client.rs:17-30). Map them to NoAuthenticatingAuthority, as direct KDC discovery/transport failures already do.

[Copilot]

🔵 Needs a closer look

The authentication state-machine and protocol changes are security-sensitive and warrant final human interoperability review.

5 open findings

• Migrate remaining tests from removed kdc_url field
• Removing kdc_url breaks dpapi-web KerberosConfig initialization
• Use lowercase error message without trailing punctuation · New
• Lowercase error message while preserving IAKERB casing · New
• Use lowercase error message without trailing punctuation · New

1 resolved since last review

• Server mechListMIC is accepted without signature verification

🧠 Review effort: Balanced

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Copilot review overview

7 open findings

• This import path for SysRng is incorrect and will not compile (hmac::digest::...::SysRng is not… · New
• Using mem::take(&mut server.state) replaces server.state with the enum default (Failed). In… · New
• Migrate remaining tests from removed kdc_url field
• Removing kdc_url breaks dpapi-web KerberosConfig initialization
• Use lowercase error message without trailing punctuation
• Lowercase error message while preserving IAKERB casing
• Use lowercase error message without trailing punctuation

🧠 Review effort: Lite

[Copilot]

🟡 Changes recommended

SPNEGO currently accepts an unadvertised IAKERB mechanism, allowing the server to change the configured KDC transport mode.

4 open findings

• Reject unoffered mechanisms before switching protocols · New
• Using mem::take(&mut server.state) replaces server.state with the enum default (Failed). In…
• Migrate remaining tests from removed kdc_url field
• Removing kdc_url breaks dpapi-web KerberosConfig initialization

4 resolved since last review

• This import path for SysRng is incorrect and will not compile (hmac::digest::...::SysRng is not…
• Use lowercase error message without trailing punctuation
• Lowercase error message while preserving IAKERB casing
• Use lowercase error message without trailing punctuation

Previously missed (2)

In code that hasn't changed since last review

Remove trailing punctuation from warning

src/​kerberos/​client/​mod.rs:118

This new warning violates the repository log-message convention by ending with punctuation. Remove the trailing ellipsis.

Add SPNEGO integration coverage for IAKERB

src/​negotiate/​generators.rs:35

The new IAKERB SPNEGO path is not covered by the added integration test, which drives Kerberos directly. Add a Negotiate-level test that verifies the IAKERB OID advertisement, proxy round trips, selected-mechanism handling, and final MIC exchange; the existing SPNEGO suite in tests/sspi/client_server/kerberos/mod.rs shows this layer is otherwise comprehensively tested.

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

SPNEGO completion handling and unsupported acceptor-side IAKERB selection can prevent authentication from completing.

4 open findings

• Migrate remaining tests from removed kdc_url field
• Removing kdc_url breaks dpapi-web KerberosConfig initialization
• Complete authentication after verifying final acceptor MIC · New
• Avoid selecting unsupported IAKERB proxy exchanges · New

2 resolved since last review

• Reject unoffered mechanisms before switching protocols
• Using mem::take(&mut server.state) replaces server.state with the enum default (Failed). In…

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The new SPNEGO IAKERB test passes an unsupported mechanism to the built-in acceptor and cannot complete authentication.

3 open findings

• Use a raw Kerberos acceptor for the IAKERB client-only test · New
• Migrate remaining tests from removed kdc_url field
• Removing kdc_url breaks dpapi-web KerberosConfig initialization

2 resolved since last review

• Avoid selecting unsupported IAKERB proxy exchanges
• Complete authentication after verifying final acceptor MIC

Previously missed (1)

In code that hasn't changed since last review

Assert against the variables actually passed to the decoder

src/​kerberos/​client/​kdc/​mod.rs:205

The decoder receives temporary clones, but the assertions below inspect the untouched originals. These assertions therefore pass even if the external-KDC path incorrectly mutates the cookie or transcript. Make the original variables mutable and pass them directly.

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Security-sensitive authentication state changes and Windows-specific interoperability behavior require final human validation.

2 open findings

• Migrate remaining tests from removed kdc_url field
• Removing kdc_url breaks dpapi-web KerberosConfig initialization

1 resolved since last review

• Use a raw Kerberos acceptor for the IAKERB client-only test

🧠 Review effort: Balanced

[Rostyslav-Romanets]

Benoît Cortier (@CBenoit) Marc-André Moreau (@mamoreau-devolutions) Hi, I have fixed all the remaining issues found by Copilot. Can you take a look? The two open findings from Copilot have been fixed, but it didn't close them.

Also, this PR should be merged after #772, which fixes the issue with mechListMIC for Kerberos client.

[Marc-André Moreau (mamoreau-devolutions)]

Rostyslav-Romanets #772 has been merged

[Rostyslav-Romanets]

Rostyslav-Romanets #772 has been merged

Marc-André Moreau (@mamoreau-devolutions) Thanks! I have also rebased this PR on the latest master, and it is ready for merge too.