feat(kerberos): add support for IAKerb extension for Kerberos client by Rostyslav-Romanets · Pull Request #751 · Devolutions/sspi-rs

Rostyslav-Romanets · 2026-09-24T15:31:58Z

This PR adds support for the IAKERB extension according to the IAKERB specification.

The main changes are focused on the Kerberos state machine. Previously, the Preauthentication state handled the entire KDC message exchange withing a single async intialize_security_context call. This approach does not work with IAKERB, where KDC messages are exchanged via a server that acts as a proxy. The Preauthentication state has therefore been split into multiple states, allowing the state machine to save Kerberos state between KDC message exchanges.

Additionaly, the AS and TGS exchanges have been extracted into separate state machines. These new state machines are KDC transport-agnostic and can be used with both external KDC and an IAKERB proxy.

What is IAKERB

IAKERB extends Kerberos to support scenarios where the client cannot directly access the KDC. Instead, KDC messages are encapsulated in GSS-API tokens and exchanged through an IAKERB proxy. The server forwards these messages to the LocalKDC, allowing the client to obtain the required Kerberos tickets without direct network access to the KDC.

Microsoft recently introduced IAKERB support in Windows Insider builds as part of its effort to reduce NTLM dependency: https://techcommunity.microsoft.com/blog/windows-itpro-blog/reducing-ntlm-dependency-iakerb-and-localkdc-in-windows-insider-preview/4524615.

Related PRs

Rostyslav-Romanets · 2026-09-24T15:34:22Z

 proptest = "1.6"
 cfg-if = "1"

+[patch.crates-io]


These patches of picky-rs can be removed once a new version containing the following changes will be released: (Devolutions/picky-rs#531) will be released.

Rostyslav-Romanets · 2026-09-24T15:35:06Z

                }

-                let neg_result = if !negotiate.mic_needed || negotiate.mic_verified {
+                // TODO(FIX): The client rejects the server's `mechListMIC`: https://github.com/Devolutions/sspi-rs/issues/748


I disabled the MIC token verification due to this issue: #748

Copilot

Copilot review overview

🟡 Changes recommended

Dependency resolution, workspace compilation, cross-realm transitions, state preservation, mechanism framing, and SPNEGO MIC verification contain blocking issues.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 4 · 2

Open (6)

CI fails because required sibling picky-rs checkout is unavailable · New
Referral processing repeats TGS response instead of requesting next realm · New
Removing kdc_url breaks dpapi-web KerberosConfig initialization · New
Server mechListMIC is accepted without signature verification · New
Fallible state transition corrupts context on error · New
IAKERB final AP-REQ uses incorrect Kerberos mechanism OID · New

What changed in this PR

Adds IAKERB proxy support to Kerberos authentication and restructures AS/TGS exchanges into resumable state machines.

Changes:

Adds IAKERB configuration, framing, cookies, transcript checksums, and SPNEGO negotiation.
Splits Kerberos client/server exchange states and secures DH private keys.
Updates callers, tests, FFI, and picky dependencies.

File	Description
`tests/sspi/client_server/kerberos/mod.rs`	Updates Kerberos configurations and exchange counts.
`tests/sspi/client_server/credssp.rs`	Updates configuration and CredSSP step count.
`src/utils.rs`	Maps IAKERB proxy errors.
`src/pku2u/server.rs`	Wraps DH private keys as secrets.
`src/pku2u/mod.rs`	Reads secret DH keys.
`src/pku2u/generators.rs`	Generates secret DH keys.
`src/pk_init.rs`	Secures DH parameters.
`src/negotiate/server.rs`	Adjusts final MIC handling.
`src/negotiate/mod.rs`	Adds IAKERB mechanism selection.
`src/negotiate/generators.rs`	Advertises the IAKERB mechanism.
`src/negotiate/client.rs`	Integrates IAKERB and MIC exchange behavior.
`src/lib.rs`	Exports KDC resolution configuration.
`src/kerberos/tests.rs`	Updates test contexts for new state fields.
`src/kerberos/server/mod.rs`	Introduces server-specific states.
`src/kerberos/server/as_exchange.rs`	Hosts transport-based AS exchange logic.
`src/kerberos/pa_datas.rs`	Reads protected DH keys.
`src/kerberos/mod.rs`	Adds split states and IAKERB context data.
`src/kerberos/messages.rs`	Encodes IAKERB proxy messages.
`src/kerberos/config.rs`	Adds KDC resolution strategies.
`src/kerberos/client/mod.rs`	Implements resumable Kerberos client exchanges.
`src/kerberos/client/kdc/tgs_exchange.rs`	Adds the TGS exchange state machine.
`src/kerberos/client/kdc/mod.rs`	Decodes direct and proxied KDC replies.
`src/kerberos/client/kdc/as_exchange.rs`	Adds the AS exchange state machine.
`src/kerberos/client/generators.rs`	Serializes authenticator extensions.
`src/kerberos/client/extractors.rs`	Validates preauthentication errors.
`src/kerberos/client/change_password.rs`	Rejects IAKERB password changes.
`src/kerberos/client/as_exchange.rs`	Removes the previous AS exchange implementation.
`src/auth_identity.rs`	Adds protected password extraction.
`ffi/src/sspi/sec_handle.rs`	Migrates FFI configuration construction.
`examples/kerberos.rs`	Updates the Kerberos example constructor.
`Cargo.toml`	Adds local picky dependency patches.
`Cargo.lock`	Records locally patched picky packages.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Rostyslav-Romanets · 2026-09-28T19:38:05Z

+pub struct KerberosConfig {
+    /// Strategy for resolving the KDC to use for Kerberos authentication.
+    pub kdc_resolution: KdcResolution,


Rostyslav-Romanets · 2026-09-25T15:23:00Z

+                // TODO(FIX): The client rejects the server's `mechListMIC`: https://github.com/Devolutions/sspi-rs/issues/748
+                // if negotiate.mic_needed {
+                //     negotiate.verify_mic_token(mech_list_mic.as_deref())?;
+                // }
+                negotiate.mic_verified = true;


The MIC token verification has an issue which is not fixed yet: #752.
The verification is commented for now, since the authentication fails.

Marc-André Moreau (mamoreau-devolutions)

Requesting changes for the three blocking issues already documented in open inline threads (avoiding duplicate comments): the sibling-only picky dependency patches prevent a clean checkout from building (#751 (comment)); cross-realm referrals never transition back to TgsRequest (#751 (comment)); and the client accepts the server mechListMIC without verification for every SPNEGO mechanism (#751 (comment)). I reproduced the dependency failure with cargo check --locked --offline -p sspi. Please resolve these before merging.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Copilot review overview

🟡 Changes recommended

The IAKERB Finished checksum currently uses the wrong key usage and byte order, preventing interoperable authentication.

Review effort: Balanced
Findings: 5

Open (5)

Encode authenticator extension fields in big-endian order · New
Use IAKERB key usage 42 for Finished checksum · New
Zeroize generated DH private key immediately · New
Server mechListMIC is accepted without signature verification
Removing kdc_url breaks dpapi-web KerberosConfig initialization

Resolved since last review (4)

Referral processing repeats TGS response instead of requesting next realm
CI fails because required sibling picky-rs checkout is unavailable
IAKERB final AP-REQ uses incorrect Kerberos mechanism OID
Fallible state transition corrupts context on error

Previously missed (1)

In code that hasn't changed since last review

Map IAKERB availability failures to NoAuthenticatingAuthority

src/utils.rs:217

Both errors mean the proxy could not reach a KDC, but mapping them to KdcInvalidRequest prevents Negotiate's documented NTLM fallback, which only handles such network/proxy failures as NoAuthenticatingAuthority (src/negotiate/client.rs:17-30). Map both IAKERB availability errors accordingly so authentication can fall back when NTLM is enabled.

Rostyslav-Romanets · 2026-09-29T11:39:03Z

+                                vec![generate_authenticator_extension(
+                                    &authenticator_sub_key,
+                                    &client.iakerb_gss_transcript,
+                                    &enc_type.cipher().checksum_type(),
+                                )?]


The KEY_USAGE_IAKERB_FINISHED should be used for interoperability with previous MIT versions: https://datatracker.ietf.org/doc/html/draft-ietf-kitten-iakerb-03#appendix-A
The real Windows implementation returns CredSSP error if KEY_USAGE_IAKERB_FINISHED is used.

Copilot

Copilot review overview

🟡 Changes recommended

Direct IAKERB contexts can incorrectly initiate U2U, proxy availability errors prevent fallback, and the new exchange lacks end-to-end coverage.

Review effort: Balanced
Findings: 4

Open (4)

Normalize IAKERB flags in the Kerberos implementation · New
Use IAKERB key usage 42 for Finished checksum
Server mechListMIC is accepted without signature verification
Removing kdc_url breaks dpapi-web KerberosConfig initialization

Resolved since last review (2)

Zeroize generated DH private key immediately
Encode authenticator extension fields in big-endian order

Previously missed (4)

In code that hasn't changed since last review

Classify proxy availability failures as NoAuthenticatingAuthority

src/utils.rs:217

Both proxy availability failures are classified as KdcInvalidRequest, so Negotiate will not take its documented network/proxy-error fallback path, which only recognizes NoAuthenticatingAuthority (src/negotiate/client.rs:17-30). These codes mean the proxy could not locate or contact a KDC, not that the client request was invalid; classify them as NoAuthenticatingAuthority so callers receive the correct SSPI status and configured NTLM fallback remains functional.

Add end-to-end multi-call IAKERB state-machine coverage

src/kerberos/client/mod.rs:276

The new multi-call IAKERB branch has no end-to-end state-machine test; the added test only exercises decode_kdc_reply. Add a mocked AS-error/AS-reply/TGS-reply exchange that checks each ContinueNeeded proxy token, cookie forwarding, transcript accumulation, and the final AP request so regressions in the core feature are detected.

Report the actual invalid server state in diagnostics

src/kerberos/client/mod.rs:697

Because mem::take has already installed the default Failed state, this error always says the context was in Failed rather than identifying the actual Final or Server state that caused the out-of-sequence call. Bind and report the consumed state instead.

Report the actual invalid client state in diagnostics

src/kerberos/server/mod.rs:171

mem::take has already replaced server.state with Failed, so this diagnostic always reports Failed instead of the actual invalid Client or Final state. Bind the matched value and format it directly to preserve an actionable out-of-sequence error.

Rostyslav-Romanets · 2026-09-29T20:56:09Z

+    loop {
+        let status = match core::mem::take(&mut client.state) {


Benoît Cortier (CBenoit) · 2026-10-01T14:31:35Z

Hi Rostyslav-Romanets

The new picky crates are now published 🙂

Benoît Cortier (CBenoit) · 2026-10-01T14:32:33Z

Copilot also still have a few "High" findings, did you confirm whether it was false positives or fixed?

feat(kerberos): add support for IAKerb extension for Kerberos client

0b7f31f

Rostyslav-Romanets commented Sep 24, 2026

View reviewed changes

This was referenced Sep 24, 2026

feat(picky-krb): add IAKerb proxy message encoding/decoding Devolutions/picky-rs#531

Merged

feat(credssp): use the KdcResolution enum instead of KDC url Devolutions/IronRDP#1987

Open

Rostyslav-Romanets marked this pull request as ready for review September 24, 2026 15:44

Copilot AI balanced review requested due to automatic review settings September 24, 2026 15:44

Copilot started reviewing on behalf of Rostyslav-Romanets September 24, 2026 15:45 View session

Copilot AI reviewed Sep 24, 2026

View reviewed changes

Marc-André Moreau (mamoreau-devolutions) requested changes Sep 28, 2026

View reviewed changes

refactor: apply code review suggestions from Copilot

ad69ea1

Rostyslav-Romanets requested a balanced review from Copilot September 28, 2026 19:39

Copilot started reviewing on behalf of Rostyslav-Romanets September 28, 2026 19:40 View session

Rostyslav-Romanets requested a review from Marc-André Moreau (mamoreau-devolutions) September 28, 2026 19:56

Copilot AI reviewed Sep 28, 2026

Benoît Cortier (CBenoit) requested a balanced review from Copilot September 29, 2026 08:50

Copilot started reviewing on behalf of Benoît Cortier (CBenoit) September 29, 2026 08:51 View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

chore(sspi): add comment explaining the Exts field encoding

0227052

Rostyslav-Romanets requested a balanced review from Copilot September 29, 2026 13:56

Copilot started reviewing on behalf of Rostyslav-Romanets September 29, 2026 13:57 View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

Rostyslav-Romanets added 2 commits September 29, 2026 22:52

refactor(sspi): apply code review suggestions

47bf2ef

chore(dependencies): bump picky to git rev with IAKERB feature

de7617c

		loop {
		let status = match core::mem::take(&mut client.state) {

Conversation

Rostyslav-Romanets commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What is IAKERB

Related PRs

Uh oh!

Rostyslav-Romanets Sep 24, 2026

Choose a reason for hiding this comment

Uh oh!

Rostyslav-Romanets Sep 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Rostyslav-Romanets Sep 28, 2026

Choose a reason for hiding this comment

Uh oh!

Rostyslav-Romanets Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Marc-André Moreau (mamoreau-devolutions) left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Rostyslav-Romanets Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Rostyslav-Romanets Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

Benoît Cortier (CBenoit) commented Oct 1, 2026

Uh oh!

Benoît Cortier (CBenoit) commented Oct 1, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

Rostyslav-Romanets commented Sep 24, 2026 •

edited

Loading

Rostyslav-Romanets Sep 29, 2026 •

edited

Loading