Convert a Kerberos based WindowsIdentity into a Base64 string

Question

If I have the following code:

var token = System.Security.Principal.WindowsIdentity.GetCurrent();

I get a WindowsIdentity that is Kerberos based. I need to make a call with a header like this:

Authorize: Negotiate <Kerberos Token Here>

Is there a way to convert that token object into a Base64 string?

score 2 · Accepted Answer · answered Nov 23 '20 at 16:49

As the maintainer of the Kerberos.NET as mentioned in the other answer, you can always go that route. However, if you want SSO using the currently signed in Windows identity you have to go through Windows' SSPI stack.

Many .NET clients already support this natively using Windows Integrated auth, its just a matter of finding the correct knobs. It's unclear what client you're using so I can't offer any suggestions beyond that.

However if this is a custom client you have to call into SSPI directly. There's a handful of really good answers for explaining how to do that such as: Client-server authentication - using SSPI?.

The aforementioned Kerberos.NET library does have a small wrapper around SSPI: https://github.com/dotnet/Kerberos.NET/blob/develop/Kerberos.NET/Win32/SspiContext.cs

It's pretty trivial:

using (var context = new SspiContext($"host/yourremoteserver.com", "Negotiate"))
{
    var tokenBytes = context.RequestToken();
    
    var header = "Negotiate " + Convert.ToBase64String(tokenBytes);
    ...
}

score 1 · Answer 2 · answered Nov 20 '20 at 21:52

I could not get this to work, but I was able to get a token using the excellent Kerberos.NET NuGet package. With that I was able to get it like this:

var client = new KerberosClient();
var kerbCred = new KerberosPasswordCredential("UserName", "p@ssword", "domain");
await client.Authenticate(kerbCred);        
Console.WriteLine(client.UserPrincipalName);
var ticket = await client.GetServiceTicket("http/ServerThatWantsTheKerberosTicket.domain.net");
return Convert.ToBase64String(ticket.EncodeGssApi().ToArray());

As an aside, I needed help figuring out what the SPN value was for the GetServiceTicket and the project maintainer was fantastically helpful (and fast!).

Convert a Kerberos based WindowsIdentity into a Base64 string

2 Answers2