PowerShell / PowerShell/Win32-OpenSSH
Support for Credential Guard
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
Summary of the new feature / enhancement
Would it be possible to support SSPI unconstrained delegation with Credential Guard enabled?
Our users currently need to turn off Credential Guard in order to delegate their ticket which is far from ideal.
When Credential Guard is enabled ssh won't perform delegation (sspi delegation was requested but not fulfilled), see
https://github.com/PowerShell/Win32-OpenSSH/issues/1606
https://github.com/PowerShell/Win32-OpenSSH/issues/1295
This limitation is documented here: https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/considerations-known-issues#kerberos-considerations
I'm not very familiar with Credential Guard, but technically the initial TGT could stay in the vault. SSH only has to produce and send the forwarded TGT.
Proposed technical implementation details (optional)
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked Win32-OpenSSH issues #1606 and #1295, then review the Microsoft Credential Guard Kerberos considerations. Trace how SSH requests SSPI delegation and determine whether a forwarded TGT can be produced while the initial TGT remains protected. Done means delegation works with Credential Guard enabled without the reported error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- authentication, operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100