GSSAPI: Error 0x80090311 returned by InitializeSecurityContext

0

I need to set up an active directory authentication system using Kerberos. My AcquireCredentialsHandleA class looks as follows. https://docs.microsoft.com/en-us/windows/win32/secauthn/acquirecredentialshandle--kerberos

SEC_WINNT_AUTH_IDENTITY AuthData, *pAuthData = NULL;
#ifdef UNICODE
    AuthData.Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE;
#else
    AuthData.Flags = SEC_WINNT_AUTH_IDENTITY_ANSI;
#endif
    unsigned char username[200] = "user";
    unsigned char domain[200] = "domain.com";
    unsigned char password[100] = "secret";
    AuthData.User = &username[0]; //username
    AuthData.Domain = &domain[0]; //domain
    AuthData.Password = &password[0]; //password
    AuthData.UserLength = AuthData.User ? sizeof(AuthData.User) : 0;
    AuthData.DomainLength = AuthData.Domain ? sizeof(AuthData.Domain) : 0;
    AuthData.PasswordLength = AuthData.Password ? sizeof(AuthData.Password) : 0;

Status = g_pSSPI->AcquireCredentialsHandleA(
        NULL,                 // Name of principal   //pN       
        ppPackageInfo[2].Name,//"kerberos" Name of package 
        SECPKG_CRED_OUTBOUND, // Flags indicating use
        NULL,                 // Pointer to logon ID
        pAuthData, //NULL,    // Package specific data
        NULL,                 // Pointer to GetKey() func
        NULL,                 // Value to pass to GetKey()
        phCreds,              // (out) Cred Handle
        &tsExpiry
    );  

This returns Success. However, when I call my InitializeSecurityContextAfunction it gives me 0x80090311 error which means SEC_E_NO_AUTHENTICATING_AUTHORITY. I have tried all sorts of possible domain name etc. When I do ksetup in the powershell it can generate ticket with same credentials. But the code always fails. Can anyone spot any problem here?

dwSSPIFlags = ISC_REQ_ALLOCATE_MEMORY | ISC_REQ_USE_SESSION_KEY | ISC_REQ_CONNECTION; // Not sure at all about them flags

    OutBuffers[0].pvBuffer = NULL;
    OutBuffers[0].BufferType = SECBUFFER_TOKEN; //2
    //OutBuffers[0].cbBuffer = 0;
    OutBuffers[0].cbBuffer = 7084;

    OutBuffer.cBuffers = 1;
    OutBuffer.pBuffers = OutBuffers;
    OutBuffer.ulVersion = SECBUFFER_VERSION; //0    
    Status = g_pSSPI->InitializeSecurityContextA
            (
                phCreds,
                fHaveCtxtHandle ? phContext : NULL,//phContext, can be NULL for the first call 
                server, 
                dwSSPIFlags,
                0,
                SECURITY_NETWORK_DREP,//SECURITY_NATIVE_DREP,
                fHaveCtxtHandle ? &InBuffer : NULL,
                0,
                fHaveCtxtHandle ? NULL : phContext ,
                &OutBuffer,
                &dwSSPIOutFlags,
                &tsExpiry
            );

Can anyone help me with this? Thanks a lot. :)

--------------------------------------------------------------- edit ---------------------------------------------------------------

    std::string fqdn = "HTTP/staging.company.com"; 
    char * server = new char[fqdn.size() + 1];
    std::copy(fqdn.begin(), fqdn.end(), server);
    server[fqdn.size()] = '\0'; 

So this is how I set up the Service name. I have this service name registered in my active directory as well. Though the address does not offer any particular service yet. Do you think that could be the problem? Another details: The Active directory is not in the same office, we tunnel to it via router.

c++
active-directory
kerberos
asked on Stack Overflow Sep 25, 2019 by Haramoz • edited Oct 1, 2019 by Haramoz

0 Answers

Nobody has answered this question yet.


User contributions licensed under CC BY-SA 3.0