How to extract Kerberos token from the output buffer of windows SSPI API?

Vishnu Gopalakrishnan 126

We have implemented Kerberos using Windows SSPI. The authentication was successful.
We want to store the Kerberos token for the future use.
How could we extract the token from the SecBufferDesc returned by the InitializeSecurityContext?
Also, how to check the token is correct or not?

bool bHaveCtxtHandle = false;
CtxtHandle contextHandle = { 0 };
SecBufferDesc outSecBufDesc;
SecBuffer outSecBuf;
SecBufferDesc inSecBufDesc;
ULONG ContextAttributes = 0U;
PBYTE pOutBuf = new BYTE[pkgInfo->cbMaxToken];
outSecBufDesc.ulVersion = 0;
outSecBufDesc.cBuffers = 1;
outSecBufDesc.pBuffers = &outSecBuf;
outSecBuf.cbBuffer = pkgInfo->cbMaxToken;
outSecBuf.BufferType = SECBUFFER_TOKEN;
outSecBuf.pvBuffer = pOutBuf;
lSecStatus = InitializeSecurityContext(&stCredHandle,
bHaveCtxtHandle ? &contextHandle : NULL,
pcPrincipalName,
ISC_REQ_USE_SUPPLIED_CREDS,
0,
SECURITY_NATIVE_DREP,
bHaveCtxtHandle ? &inSecBufDesc : NULL,
0,
&contextHandle,
&outSecBufDesc,
&ContextAttributes,
&SecurityContextLifetime);

Judy Jing Zhang 1 Reputation point

2021-09-02T06:09:25.767+00:00

hi, @Vishnu Gopalakrishnan could i know how you implement the Kerberos authentication using SSPI, could you share your sample code? i want to use SSPI to set up secure communication, but when do authentication, it always downgraded to NTLM, am not sure why. i have used setspn to register the SPN name and set it as target name, but still failed. could you help me? thank you so much!
Vishnu Gopalakrishnan 126 Reputation points

2021-09-02T09:01:02.073+00:00

We have taken as a reference.
Judy Jing Zhang 1 Reputation point

2021-09-02T09:07:30.353+00:00

yes, thanks for your reply, i have seen this article. And what's the parameter do you use for target name in InitializeSecurityContext? just use domain user name? do you do some additional configuration for domain? because when i use domain user in this authentication function, it still uses NTLM protocol.

1 answer

Xiaopo Yang - MSFT 12,231 Reputation points Microsoft Vendor

2021-09-02T06:35:27.66+00:00

Perhaps SECBUFFER_TOKEN you wanted.

SECBUFFER_TOKEN 2 (0x2) The buffer contains the security token portion of the message. This is read-only for input parameters or read/write for output parameters.
Please sign in to rate this answer.
Vishnu Gopalakrishnan 126 Reputation points

2021-09-02T07:16:33.36+00:00

Sorry, how I use SECBUFFER_TOKEN ? i.e in which way we store it? Decrypt? or binary or char? Any samples please.

Can i use QueryContextAttributes(&contextHandle, SECPKG_ATTR_ACCESS_TOKEN, pBuffer); On my checking it failed with 0x8009030b

Xiaopo Yang - MSFT 12,231 Reputation points Microsoft Vendor

2021-09-02T09:04:54.397+00:00

0x8009030B is SEC_E_NO_IMPERSONATION. And you may try the char token.
Here is the error source.

If the security context is for a server or is incomplete, the returned handle may be NULL. Depending on the security package, QueryContextAttributes (General) may return SEC_E_NO_IMPERSONATION for these cases.

Vishnu Gopalakrishnan 126 Reputation points

2021-09-03T03:23:52.333+00:00

Thanks for the reply. This I could see. Is there any cpp samples available to fetch the Kerberos token?

Fei Xue - MSFT 1,111 Reputation points

2021-09-16T05:45:55.117+00:00

@Vishnu Gopalakrishnan , It is recommend that to open a ticket for this issue so that our engineer could work closely with you to resolve this issue as soon as possible since it is complex. Please visit the below link below and get the technical support for Windows SDK by submit the incident:
https://developer.microsoft.com/en-us/windows/support/
Sign in to comment

Share via

How to extract Kerberos token from the output buffer of windows SSPI API?

1 answer