localkdc demo: cross-realm IAKerb does not work yet

[abbra]

With commit abbra@928652f we can create cross-realm trust between the two demo hosts. However, an attempt to connect to the other system using Kerberos TGT for a user from the local KDC does not work because gss_init_sec_context() processing cannot complete and we cannot get the service ticket locally.

$ KRB5_TRACE=/dev/stdout smbclient --use-kerberos=required --use-krb5-ccache=KCM: --client-protection=encrypt //asn.localkdc.test/homes
gensec_gse_iakerb_client_start: No password for user principal[testuser@AB.LOCALKDC.SITE]
[682] 1737890929.509988: Getting credentials testuser@AB.LOCALKDC.SITE -> cifs/asn.localkdc.test@AB.LOCALKDC.SITE using ccache KCM:1000:29129
[682] 1737890929.509989: Retrieving testuser@AB.LOCALKDC.SITE -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from KCM:1000:29129 with result: -1765328243/Matching credential not found
[682] 1737890929.509990: Retrieving testuser@AB.LOCALKDC.SITE -> cifs/asn.localkdc.test@AB.LOCALKDC.SITE from KCM:1000:29129 with result: -1765328243/Matching credential not found
[682] 1737890929.509991: Retrieving testuser@AB.LOCALKDC.SITE -> krbtgt/AB.LOCALKDC.SITE@AB.LOCALKDC.SITE from KCM:1000:29129 with result: 0/Success
[682] 1737890929.509992: Starting with TGT for client realm: testuser@AB.LOCALKDC.SITE -> krbtgt/AB.LOCALKDC.SITE@AB.LOCALKDC.SITE
[682] 1737890929.509993: Requesting tickets for cifs/asn.localkdc.test@AB.LOCALKDC.SITE, referrals on
[682] 1737890929.509994: Generated subkey for TGS request: aes256-sha2/87C0
[682] 1737890929.509995: etypes requested in TGS request: aes256-sha2, aes128-sha2, aes256-cts, aes128-cts, camellia256-cts, camellia128-cts
[682] 1737890929.509997: Encoding request body and padata into FAST request
[682] 1737890929.509998: Sending request (1167 bytes) to AB.LOCALKDC.SITE
[682] 1737890929.509999: Sending TCP request to UNIX domain socket /run/localkdc/kdc.sock
[682] 1737890929.510000: Received answer (467 bytes) from UNIX domain socket /run/localkdc/kdc.sock
[682] 1737890929.510001: Terminating TCP connection to UNIX domain socket /run/localkdc/kdc.sock
[682] 1737890929.510002: Sending DNS URI query for _kerberos.AB.LOCALKDC.SITE.
[682] 1737890929.510003: No URI records found
[682] 1737890929.510004: No SRV records found
[682] 1737890929.510005: Response was not from primary KDC
[682] 1737890929.510006: Decoding FAST response
[682] 1737890929.510007: TGS request result: -1765328377/Server cifs/asn.localkdc.test@AB.LOCALKDC.SITE not found in Kerberos database
[682] 1737890929.510008: Requesting tickets for cifs/asn.localkdc.test@AB.LOCALKDC.SITE, referrals off
[682] 1737890929.510009: Generated subkey for TGS request: aes256-sha2/3F80
[682] 1737890929.510010: etypes requested in TGS request: aes256-sha2, aes128-sha2, aes256-cts, aes128-cts, camellia256-cts, camellia128-cts
[682] 1737890929.510012: Encoding request body and padata into FAST request
[682] 1737890929.510013: Sending request (1167 bytes) to AB.LOCALKDC.SITE
[682] 1737890929.510014: Sending TCP request to UNIX domain socket /run/localkdc/kdc.sock
[682] 1737890929.510015: Received answer (467 bytes) from UNIX domain socket /run/localkdc/kdc.sock
[682] 1737890929.510016: Terminating TCP connection to UNIX domain socket /run/localkdc/kdc.sock
[682] 1737890929.510017: Sending DNS URI query for _kerberos.AB.LOCALKDC.SITE.
[682] 1737890929.510018: No URI records found
[682] 1737890929.510019: No SRV records found
[682] 1737890929.510020: Response was not from primary KDC
[682] 1737890929.510021: Decoding FAST response
[682] 1737890929.510022: TGS request result: -1765328377/Server cifs/asn.localkdc.test@AB.LOCALKDC.SITE not found in Kerberos database
[682] 1737890929.510023: Getting credentials testuser@AB.LOCALKDC.SITE -> cifs/asn.localkdc.test@ASN.LOCALKDC.SITE using ccache KCM:1000:29129
[682] 1737890929.510024: Retrieving testuser@AB.LOCALKDC.SITE -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from KCM:1000:29129 with result: -1765328243/Matching credential not found
[682] 1737890929.510025: Retrieving testuser@AB.LOCALKDC.SITE -> cifs/asn.localkdc.test@ASN.LOCALKDC.SITE from KCM:1000:29129 with result: -1765328243/Matching credential not found
[682] 1737890929.510026: Retrieving testuser@AB.LOCALKDC.SITE -> krbtgt/ASN.LOCALKDC.SITE@ASN.LOCALKDC.SITE from KCM:1000:29129 with result: 0/Success
[682] 1737890929.510027: Found cached TGT for service realm: testuser@AB.LOCALKDC.SITE -> krbtgt/ASN.LOCALKDC.SITE@AB.LOCALKDC.SITE
[682] 1737890929.510028: Requesting tickets for cifs/asn.localkdc.test@ASN.LOCALKDC.SITE, referrals on
[682] 1737890929.510029: Generated subkey for TGS request: aes256-sha2/E74D
[682] 1737890929.510030: etypes requested in TGS request: aes256-sha2, aes128-sha2, aes256-cts, aes128-cts, camellia256-cts, camellia128-cts
[682] 1737890929.510032: Encoding request body and padata into FAST request
[682] 1737890929.510033: Sending request (1189 bytes) to ASN.LOCALKDC.SITE
[682] 1737890929.510034: Sending DNS URI query for _kerberos.ASN.LOCALKDC.SITE.
[682] 1737890929.510035: No URI records found
[682] 1737890929.510036: Sending DNS SRV query for _kerberos._udp.ASN.LOCALKDC.SITE.
[682] 1737890929.510037: Sending DNS SRV query for _kerberos._tcp.ASN.LOCALKDC.SITE.
[682] 1737890929.510038: No SRV records found
gse_get_client_auth_token: gss_init_sec_context failed with [Unspecified GSS failure.  Minor code may provide more information: Cannot find KDC for realm "ASN.LOCALKDC.SITE"](2529639066)
gensec_spnego_client_negTokenInit_step: gse_krb5: creating NEG_TOKEN_INIT for cifs/asn.localkdc.test failed (next[(null)]): NT_STATUS_LOGON_FAILURE
session setup failed: NT_STATUS_LOGON_FAILURE

[abbra]

At this point I am not sure is it a missing functionality in MIT Kerberos GSSAPI code or we need some changes to be done in https://git.samba.org/?p=asn/samba.git;a=log;h=refs/heads/asn-iakerb

[abbra]

I re-ran with more debug information from Samba side and it is because current implementation of iakerb in Samba does not support using pre-defined Kerberos credentials:

Connecting to 192.168.221.3 at port 445
socket options: SO_KEEPALIVE=0, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=9, TCP_KEEPIDLE=7200, TCP_KEEPINTVL=75, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=131072, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0
 session request ok
 negotiated dialect[SMB3_11] against server[asn.localkdc.test]
cli_session_setup_spnego_send: Connect to asn.localkdc.test as testuser@AB.LOCALKDC.SITE using SPNEGO
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'ncalrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'http_negotiate' registered
Starting GENSEC mechanism spnego
Starting GENSEC submechanism gse_iakerb
gensec_gse_iakerb_client_start: Kerberos required username[testuser@AB.LOCALKDC.SITE]
gensec_gse_iakerb_client_start: No password for user principal[testuser@AB.LOCALKDC.SITE]
Failed to start GENSEC client mech gse_iakerb: NT_STATUS_WRONG_CREDENTIAL_HANDLE
Starting GENSEC submechanism gse_krb5
gensec_gse_client_prepare_ccache: Kerberos required username[testuser@AB.LOCALKDC.SITE]
gensec_gse_client_prepare_ccache: No kinit required for testuser@AB.LOCALKDC.SITE to access cifs/asn.localkdc.test, KCM:1000:29129
[819] 1737895271.103460: Getting credentials testuser@AB.LOCALKDC.SITE -> cifs/asn.localkdc.test@AB.LOCALKDC.SITE using ccache KCM:1000:29129
[819] 1737895271.103461: Retrieving testuser@AB.LOCALKDC.SITE -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from KCM:1000:29129 with result: -1765328243/Matching credential not found
[819] 1737895271.103462: Retrieving testuser@AB.LOCALKDC.SITE -> cifs/asn.localkdc.test@AB.LOCALKDC.SITE from KCM:1000:29129 with result: -1765328243/Matching credential not found
[819] 1737895271.103463: Retrieving testuser@AB.LOCALKDC.SITE -> krbtgt/AB.LOCALKDC.SITE@AB.LOCALKDC.SITE from KCM:1000:29129 with result: 0/Success
[819] 1737895271.103464: Starting with TGT for client realm: testuser@AB.LOCALKDC.SITE -> krbtgt/AB.LOCALKDC.SITE@AB.LOCALKDC.SITE
[819] 1737895271.103465: Requesting tickets for cifs/asn.localkdc.test@AB.LOCALKDC.SITE, referrals on
[819] 1737895271.103466: Generated subkey for TGS request: aes256-sha2/51B0
[819] 1737895271.103467: etypes requested in TGS request: aes256-sha2, aes128-sha2, aes256-cts, aes128-cts, camellia256-cts, camellia128-cts
[819] 1737895271.103469: Encoding request body and padata into FAST request
[819] 1737895271.103470: Sending request (1167 bytes) to AB.LOCALKDC.SITE
[819] 1737895271.103471: Sending TCP request to UNIX domain socket /run/localkdc/kdc.sock
[819] 1737895271.103472: Received answer (467 bytes) from UNIX domain socket /run/localkdc/kdc.sock
[819] 1737895271.103473: Terminating TCP connection to UNIX domain socket /run/localkdc/kdc.sock
[819] 1737895271.103474: Sending DNS URI query for _kerberos.AB.LOCALKDC.SITE.
[819] 1737895271.103475: No URI records found
[819] 1737895271.103476: No SRV records found
[819] 1737895271.103477: Response was not from primary KDC
[819] 1737895271.103478: Decoding FAST response
[819] 1737895271.103479: TGS request result: -1765328377/Server cifs/asn.localkdc.test@AB.LOCALKDC.SITE not found in Kerberos database
[819] 1737895271.103480: Requesting tickets for cifs/asn.localkdc.test@AB.LOCALKDC.SITE, referrals off
[819] 1737895271.103481: Generated subkey for TGS request: aes256-sha2/D5A2
[819] 1737895271.103482: etypes requested in TGS request: aes256-sha2, aes128-sha2, aes256-cts, aes128-cts, camellia256-cts, camellia128-cts
[819] 1737895271.103484: Encoding request body and padata into FAST request
[819] 1737895271.103485: Sending request (1167 bytes) to AB.LOCALKDC.SITE
[819] 1737895271.103486: Sending TCP request to UNIX domain socket /run/localkdc/kdc.sock
[819] 1737895271.103487: Received answer (467 bytes) from UNIX domain socket /run/localkdc/kdc.sock
[819] 1737895271.103488: Terminating TCP connection to UNIX domain socket /run/localkdc/kdc.sock
[819] 1737895271.103489: Sending DNS URI query for _kerberos.AB.LOCALKDC.SITE.
[819] 1737895271.103490: No URI records found
[819] 1737895271.103491: No SRV records found
[819] 1737895271.103492: Response was not from primary KDC
[819] 1737895271.103493: Decoding FAST response
[819] 1737895271.103494: TGS request result: -1765328377/Server cifs/asn.localkdc.test@AB.LOCALKDC.SITE not found in Kerberos database
[819] 1737895271.103495: Getting credentials testuser@AB.LOCALKDC.SITE -> cifs/asn.localkdc.test@ASN.LOCALKDC.SITE using ccache KCM:1000:29129
[819] 1737895271.103496: Retrieving testuser@AB.LOCALKDC.SITE -> krb5_ccache_conf_data/start_realm@X-CACHECONF: from KCM:1000:29129 with result: -1765328243/Matching credential not found
[819] 1737895271.103497: Retrieving testuser@AB.LOCALKDC.SITE -> cifs/asn.localkdc.test@ASN.LOCALKDC.SITE from KCM:1000:29129 with result: -1765328243/Matching credential not found
[819] 1737895271.103498: Retrieving testuser@AB.LOCALKDC.SITE -> krbtgt/ASN.LOCALKDC.SITE@ASN.LOCALKDC.SITE from KCM:1000:29129 with result: 0/Success
[819] 1737895271.103499: Found cached TGT for service realm: testuser@AB.LOCALKDC.SITE -> krbtgt/ASN.LOCALKDC.SITE@AB.LOCALKDC.SITE
[819] 1737895271.103500: Requesting tickets for cifs/asn.localkdc.test@ASN.LOCALKDC.SITE, referrals on
[819] 1737895271.103501: Generated subkey for TGS request: aes256-sha2/5491
[819] 1737895271.103502: etypes requested in TGS request: aes256-sha2, aes128-sha2, aes256-cts, aes128-cts, camellia256-cts, camellia128-cts
[819] 1737895271.103504: Encoding request body and padata into FAST request
[819] 1737895271.103505: Sending request (1189 bytes) to ASN.LOCALKDC.SITE
[819] 1737895271.103506: Sending DNS URI query for _kerberos.ASN.LOCALKDC.SITE.
[819] 1737895271.103507: No URI records found
[819] 1737895271.103508: Sending DNS SRV query for _kerberos._udp.ASN.LOCALKDC.SITE.
[819] 1737895271.103509: Sending DNS SRV query for _kerberos._tcp.ASN.LOCALKDC.SITE.
[819] 1737895271.103510: No SRV records found
gse_get_client_auth_token: gss_init_sec_context failed with [Unspecified GSS failure.  Minor code may provide more information: Cannot find KDC for realm "ASN.LOCALKDC.SITE"](2529639066)
gensec_update_send: gse_krb5[0x55fb9a4001a0]: subreq: 0x55fb9a3e35d0
gensec_update_send: spnego[0x55fb9a3e2070]: subreq: 0x55fb9a3ff780
gensec_update_done: gse_krb5[0x55fb9a4001a0]: NT_STATUS_LOGON_FAILURE tevent_req[0x55fb9a3e35d0/../../source3/librpc/crypto/gse.c:1457]: state[3] error[-7963671676338569107 (0x917B5ACDC000006D)]  state[struct gensec_gse_update_state (0x55fb9a3e37b0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:1471]
gensec_spnego_client_negTokenInit_step: gse_krb5: creating NEG_TOKEN_INIT for cifs/asn.localkdc.test failed (next[(null)]): NT_STATUS_LOGON_FAILURE
gensec_update_done: spnego[0x55fb9a3e2070]: NT_STATUS_LOGON_FAILURE tevent_req[0x55fb9a3ff780/../../auth/gensec/spnego.c:1614]: state[3] error[-7963671676338569107 (0x917B5ACDC000006D)]  state[struct gensec_spnego_update_state (0x55fb9a3ff960)] timer[(nil)] finish[../../auth/gensec/spnego.c:2032]
SPNEGO login failed: The attempted logon is invalid. This is either due to a bad username or authentication information.
session setup failed: NT_STATUS_LOGON_FAILURE
Freeing parametrics:

We skip iakerb completely in this case and go to normal krb5 submechanism which is not usable. I need to see how we can add this usage.