Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for the GSSAPI SASL mechanism #1249

Open
JMyklebust opened this issue Aug 31, 2021 · 13 comments
Open

Add support for the GSSAPI SASL mechanism #1249

JMyklebust opened this issue Aug 31, 2021 · 13 comments
Labels
enhancement New feature or request

Comments

@JMyklebust
Copy link

Ref. issue #890, there is a Kerberos .net library here: https://github.com/dotnet/Kerberos.NET.

Would i be possible to get support for kerberos authentication in MailKit with that at some point?

@jstedfast jstedfast added the enhancement New feature or request label Aug 31, 2021
@jstedfast
Copy link
Owner

I actually came across that the other day as I was searching to see if anyone had implemented a managed NTLM library for .NET and thought about possibly adding Kerberos support.

@SuperFlue
Copy link

Would be great to see Kerberos support, NTLM would be convenient.
But security wise it would better to have support for Kerberos.

@jstedfast
Copy link
Owner

Just to make sure I know which SASL mechanism you guys want, what are the AUTH mechanism names that your SMTP/POP3/IMAP servers are reporting?

I'm assuming GSSAPI?

Back in the day (20 years ago), KERBEROS_V4 and GSSAPI were the 2 I had implemented in C, but these days it looks like there might be more variants than that:

https://www.iana.org/assignments/sasl-mechanisms/sasl-mechanisms.xhtml

@JMyklebust
Copy link
Author

In my specific case it's a SMTP server that reports GSSAPI yes.

@jstedfast jstedfast changed the title Kerberos support Add support for the GSSAPI SASL mechanism Sep 4, 2021
@jstedfast
Copy link
Owner

This doesn't look like it will be as easy as I had hoped. Kerberos.NET doesn't implement any of the GSS API's. Kerberos is only a small part of GSS afaict.

@jstedfast
Copy link
Owner

jstedfast commented Sep 18, 2021

@JMyklebust
Copy link
Author

That's some big specifications.... 😅

Maybe a somewhat naive question:
Could you leverage the Windows APIs for this?
Example: https://docs.microsoft.com/en-us/windows/win32/secauthn/sspi-kerberos-interoperability-with-gssapi
Obviously that wont be a solid cross-platform solution, but as a stopgap?

Of course, if that just adds lots of extra work that you cannot really re-use for cross-platform. Then I guess I'll just sit tight til you hopefully find time to implement this in a proper way.

MailKit is a great library regardless, keep up the good work. 😄

@Evengard
Copy link

Evengard commented Apr 21, 2023

Erhm, I had success with GSSAPI authentication (via SPNEGO) on Ldap (https://github.com/dsbenghe/Novell.Directory.Ldap.NETStandard) with Kerberos.NET, aka fully managed. What is not supported in Kerberos.NET that you need? It have an EncodeGssApi function which should be enough. Or is there smth else?

@jstedfast
Copy link
Owner

Need a bit more than an encoder.

Btw, your ldap link does not implement GSS-API either 😁

@Evengard
Copy link

Yeah, because I extended it for the said implementation. Work-related code. There was nothing special though. Basically after reading https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SSEAN/%5bMS-SSEAN%5d.pdf and https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SPNG/%5bMS-SPNG%5d.pdf, and seeing that all theese token implementations are present in Kerberos.NET, shouldn't be too complex to implement.

@jstedfast
Copy link
Owner

shouldn't be too complex to implement

Good, then I'll expect that patch from you by tomorrow ;-)

@Evengard
Copy link

xD If only I had more time that could very well happen xD

@jstedfast
Copy link
Owner

I'm thinking that this should probably be a separate MailKit.Security.Gssapi nuget package if/when I (or someone else) ever get around to implementing it.

I'd love to see this supported in MailKit, but I'm just not seeing the demand so it's been a very low priority for me (especially now that I have had so little free time to work on this and other side projects).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

4 participants