PowerShell / PowerShell/Win32-OpenSSH
ssh login with constrained kerberos delegation
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
Summary of the new feature / enhancement
Currently, we use unconstrained Kerberos delegation for logging in and accessing network drives, which poses security concerns.
When attempting to switch to constrained Kerberos delegation, the error sspi delegation was requested but not fulfilled occurs, and no tickets are available on the host. It would be beneficial to utilize constrained Kerberos delegation.
This issue is related to #2214
Proposed technical implementation details (optional)
I think we want S4U2proxy. According to https://web.mit.edu/kerberos/krb5-1.20/doc/appdev/gssapi.html gss_acquire_cred_impersonate_name has to be used, which is similar to gss_acquire_cred, which is currently used.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names S4U2proxy, gss_acquire_cred_impersonate_name, and the current gss_acquire_cred usage, but no files or tests. Start by reviewing related issue #2214 and locating the current credential-acquisition path. Done should mean constrained delegation works without the SSPI error and tickets are available on the host.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- authentication, networking, operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100