Gtting 401 error with client generated Kerbeors token added to .net 7 httpclient #361
Comments
|
This isn't likely a bug in the library. The server isn't accepting the ticket, but you aren't showing why the server isn't accepting it. Logs from the server would be useful. A comparison of the ticket sent by chrome would also be useful.
I'd guess chrome is falling back to NTLM or it's using a different SPN.
…________________________________
From: RussKahler1970 ***@***.***>
Sent: Friday, December 1, 2023 6:51:09 AM
To: dotnet/Kerberos.NET ***@***.***>
Cc: Subscribed ***@***.***>
Subject: [dotnet/Kerberos.NET] Gtting 401 error with client generated Kerbeors token added to .net 7 httpclient (Issue #361)
Describe the bug
cannot get token to authenticate
To Reproduce
.net 7 app Using httpclient with UserDeaultCredentials set to falue
var client = ClientFactory.CreateClient("SuperAssociate");
HttpContent inputContent = new StringContent(GetEvent(), System.Text.Encoding.UTF8, "application/json");
DnsQuery.RegisterImplementation(new PlatformIndependentDnsClient());
var kClient = new KerberosClient();
var kerbCred = new KerberosPasswordCredential("XXXXXX", "YYYYYYY", "salelytics.local");
await kClient.Authenticate(kerbCred);
var ticket = await kClient.GetServiceTicket("host/webtest01.salelytics.local");
var apiHost = "http://webtest01.salelytics.local/";
Guard.Against.NullOrEmpty(apiHost);
client.BaseAddress = new Uri(apiHost);
var apiSite = "SuperAssociateRuss/api/IncomingEvent/";
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Negotiate", Convert.ToBase64String(ticket.EncodeGssApi().ToArray()));
var apiResponse = await client.PostAsync(apiSite, inputContent);
Expected behavior
The Authorization Header should validate as my user
The token I get from Kerbeoros.Net is different from the one my chrome browser is sending. should it be the same?
—
Reply to this email directly, view it on GitHub<#361> or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAJHTYIRP5JZ6C5RGIUUUWDYHHVF5BFKMF2HI4TJMJ2XIZLTSSBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJLJONZXKZNENZQW2ZNLORUHEZLBMRPXI6LQMWBKK5TBNR2WLKJVGY2DENZSGM2TLJDOMFWWLKLIMFZV63DBMJSWZAVFOZQWY5LFUR2HE5LFURXGC3LFVZ3WC5DDNBPWCY3UNF3GS5DZVRZXKYTKMVRXIX3UPFYGLJKJONZXKZNGORXXA2LDOOJYFJDUPFYGLKTSMVYG643JORXXE6NFOZQWY5LFVA4DKNBYHEYTGOECUR2HS4DFUVUXG43VMWSXMYLMOVS2UMRQGIYTAMZYGE3DFAVEOR4XAZNFNRQWEZLMUV3GC3DVMWUTKNRUGI3TEMZVGWTXI4TJM5TWK4VGMNZGKYLUMU>.
You are receiving this email because you are subscribed to this thread.
Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.
|
|
I changed the site to only allow Kerberos so Chrome is only using Kerberos. Here are the two tokens: Token from Kerberos.net |
|
Sorry, I failed to add that the Kerberos.net user and windows user for Chrome are the same. |
|
Its highly possible I have something wrong elsewhere. do you know how to get more info on why it failed? what tool can I use to trace the failed Authentication in windows/IIS? |
|
Alright, let's see: Chrome:
Kerberos.NET
There's a noticeable difference in the structure because the top-level structures are encoded differently. You can see the differences in the bold headers. I also noticed the tool (bruce kdecode) took an extra second to process it, meaning it was searching for the structure in the blob. That would suggest the output is encoded wrong. Maybe there is a bug in Kerberos.NET. |
|
the SNAME is different too: Should I use http/webtest01.salelytics.local when I get the ticket? |
|
I am using this to encode the ticket. Is that right for windows IIS? |
|
Okay, the difference in decoding is a bug in Bruce itself, not the library.
This shows it's decoding correctly.
This is a good candidate for testing next. HTTP is an alias for HOST in Windows, but if you have an explicit HTTP SPN registration that will take priority.
Is fine. |
|
Note that the and the name is different e.g. |
|
That's what public ReadOnlyMemory<byte> EncodeGssApi()
{
var token = GssApiToken.Encode(Kerberos5Oid, this);
var negoToken = new NegotiationToken
{
InitialToken = new NegTokenInit
{
MechTypes = new[] { Kerberos5Oid },
MechToken = token
}
};
return GssApiToken.Encode(SPNegoOid, negoToken);
} |
|
Although... the KVNO on both the chrome and kerb.net tickets are the same, which given that it's non-zero would suggest they're the same service principal too. Are you seeing anything on the web server side in the event logs indicating why it's failing? |
|
I see this in the iis log. I don't see anything in Event Viewer at this tine. I can do more search on the server. |
|
One other note on this. the Kerberos ticket generated with chrome works and validates. The site in question requires windows authentication and only has Negotiate as the only provider. |
|
I tried http/webtest01.salelytics.local and it failed too. |
|
BTW is there reason why you use Kerberos.net primitives instead of HttpClient directly - just curious. |
|
well the end goal is for this to run in a linux container that is not joined to our domain. I was hoping to use Kerberos.Net to get a kerberos token and use it for authentication to a site that requires windows authentication. my containers will be running in AWS Fargate/ECS serverless environmennt in a vpc that is connected to our domain. |
|
Okay, I see what the problem might be. This is interesting. The chrome message is decoding with OIDs And the Kerberos.NET message is decoding as Which is abnormal because But we aren't because of this change: https://github.com/dotnet/Kerberos.NET/blame/7be209d7549417cf0d4fdd178266417c39cc7efe/Kerberos.NET/Entities/MechType.cs#L15 Oops. That's just wrong one way or another so it needs to be fixed anyway, so let's see if this fixes it. |
|
the .Net 7 is not working to build a credential cache for the user either. |
|
Is there a way to get pull or build that I could test? I am currently using the nuget package form nuget.org |
|
Yeah, I'm going to push up a prelease package. |
|
sweet lust let me know when it up there I can download and test it out. |
|
Hot off the press: https://www.nuget.org/packages/Kerberos.NET/4.6.48-gbe643a489a It'll take a minute to index. |
|
Sweet first test but I got back 200!!!! |
|
I've merged that fix. I don't expect you'll see any other issues related to this in particular. I'll get a proper release of the package out this weekend or early next week once I've figured out how to get a proper test on this. |
|
Thanks for all your help on this. |
|
Is there someplace I can go to get more info on this package? How best to use it for high volume of calls using Kerberos tickets, cache, refreshing, etc. |
|
Here's as good a place as any, though in a separate issue preferably. There isn't much in the way of one-size-fits-all guidance especially because if you're using this library it's likely for reasons that don't normally fit the usage of other libraries like the standard GSS libraries. |
|
How do I add a discussion about usage? its not really an issue or feature.
…On Mon, Dec 4, 2023 at 3:41 PM Steve Syfuhs ***@***.***> wrote:
Here's as good a place as any, though in a separate issue preferably.
There isn't much in the way of one-size-fits-all guidance especially
because if you're using this library it's likely for reasons that don't
normally fit the usage of other libraries like the standard GSS libraries.
—
Reply to this email directly, view it on GitHub
<#361 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AR2QYLH4UJLMAN4DWHMABZ3YHY7O3AVCNFSM6AAAAABAC6SS3WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMZZGUZDIOJSGU>
.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
|
Just create an issue and put a label on it as a |
|
Hi! For now I'm using a keytab and use the authenticate function in order to get a valid token, whenever I try to use it in order to access a third party api I'm getting the mentioned error 401. Thanks |
|
You'll have to investigate why the third party is rejecting it. This library can't tell you why other platforms are rejecting it unfortunately.
…________________________________
From: DanielMGoldberg ***@***.***>
Sent: Monday, June 10, 2024 1:53:19 AM
To: dotnet/Kerberos.NET ***@***.***>
Cc: Comment ***@***.***>; Subscribed ***@***.***>
Subject: Re: [dotnet/Kerberos.NET] Gtting 401 error with client generated Kerbeors token added to .net 7 httpclient (Issue #361)
Hi!
I have a similar issue, I'm currently getting 401 whenever I set use defaultcredentials to false.
For now I'm using a keytab and use the authenticate function in order to get a valid token, whenever I try to use it in order to access a third party api I'm getting the mentioned error 401.
Thanks
—
Reply to this email directly, view it on GitHub<#361 (comment)> or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAJHTYOJ44QR3FV5SPXOQDTZGVSP7BFKMF2HI4TJMJ2XIZLTSSBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDUOJ2WLJDOMFWWLLTXMF2GG2C7MFRXI2LWNF2HTAVFOZQWY5LFUVUXG43VMWSG4YLNMWVXI2DSMVQWIX3UPFYGLAVFOZQWY5LFVE2TMNBSG4ZDGNJVURXGC3LFVFUGC427NRQWEZLMVRZXKYTKMVRXIX3UPFYGLLCJONZXKZKDN5WW2ZLOOSTHI33QNFRXHE4CUR2HS4DFVJZGK4DPONUXI33SPGSXMYLMOVS2QOBVGQ4DSMJTHCBKI5DZOBS2K2LTON2WLJLWMFWHKZNKGIYDEMJQGM4DCNRSQKSHI6LQMWSWYYLCMVWKK5TBNR2WLKJVGY2DENZSGM2TLJ3UOJUWOZ3FOKTGG4TFMF2GK>.
You are receiving this email because you commented on the thread.
Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.
|
Describe the bug
cannot get token to authenticate
To Reproduce
.net 7 app Using httpclient with UserDeaultCredentials set to falue
Expected behavior
The Authorization Header should validate as my user
The token I get from Kerbeoros.Net is different from the one my chrome browser is sending. should it be the same?
The text was updated successfully, but these errors were encountered: