add Kerberos auth support

go.mod

@@ -4,5 +4,12 @@ go 1.11
 
 require (
 	github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe
+	github.com/hashicorp/go-uuid v1.0.2 // indirect
+	github.com/jcmturner/gofork v1.0.0 // indirect
 	golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c
+	gopkg.in/jcmturner/aescts.v1 v1.0.1 // indirect
+	gopkg.in/jcmturner/dnsutils.v1 v1.0.1 // indirect
+	gopkg.in/jcmturner/goidentity.v3 v3.0.0 // indirect
+	gopkg.in/jcmturner/gokrb5.v7 v7.5.0
+	gopkg.in/jcmturner/rpc.v1 v1.1.0 // indirect
 )

go.sum

@@ -1,5 +1,19 @@
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/hashicorp/go-uuid v1.0.2 h1:cfejS+Tpcp13yd5nYHWDI6qVCny6wyX2Mt5SGur2IGE=
+github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/jcmturner/gofork v1.0.0 h1:J7uCkflzTEhUZ64xqKnkDxq3kzc96ajM1Gli5ktUem8=
+github.com/jcmturner/gofork v1.0.0/go.mod h1:MK8+TM0La+2rjBD4jE12Kj1pCCxK7d2LK/UM3ncEo0o=
 golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c h1:Vj5n4GlwjmQteupaxJ9+0FNOmBrHfq7vN4btdGoDZgI=
 golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+gopkg.in/jcmturner/aescts.v1 v1.0.1 h1:cVVZBK2b1zY26haWB4vbBiZrfFQnfbTVrE3xZq6hrEw=
+gopkg.in/jcmturner/aescts.v1 v1.0.1/go.mod h1:nsR8qBOg+OucoIW+WMhB3GspUQXq9XorLnQb9XtvcOo=
+gopkg.in/jcmturner/dnsutils.v1 v1.0.1 h1:cIuC1OLRGZrld+16ZJvvZxVJeKPsvd5eUIvxfoN5hSM=
+gopkg.in/jcmturner/dnsutils.v1 v1.0.1/go.mod h1:m3v+5svpVOhtFAP/wSz+yzh4Mc0Fg7eRhxkJMWSIz9Q=
+gopkg.in/jcmturner/goidentity.v3 v3.0.0 h1:1duIyWiTaYvVx3YX2CYtpJbUFd7/UuPYCfgXtQ3VTbI=
+gopkg.in/jcmturner/goidentity.v3 v3.0.0/go.mod h1:oG2kH0IvSYNIu80dVAyu/yoefjq1mNfM5bm88whjWx4=
+gopkg.in/jcmturner/gokrb5.v7 v7.5.0 h1:a9tsXlIDD9SKxotJMK3niV7rPZAJeX2aD/0yg3qlIrg=
+gopkg.in/jcmturner/gokrb5.v7 v7.5.0/go.mod h1:l8VISx+WGYp+Fp7KRbsiUuXTTOnxIc3Tuvyavf11/WM=
+gopkg.in/jcmturner/rpc.v1 v1.1.0 h1:QHIUxTX1ISuAv9dD2wJ9HWQVuWDX/Zc0PfeC2tjc4rU=
+gopkg.in/jcmturner/rpc.v1 v1.1.0/go.mod h1:YIdkC4XfD6GXbzje11McwsDuOlZQSb9W4vfLvuNnlv8=

kerbauth.go

@@ -0,0 +1,173 @@
+package mssql
+
+import (
+	"fmt"
+	"io/ioutil"
+	"os"
+	"strconv"
+	"strings"
+
+	"gopkg.in/jcmturner/gokrb5.v7/client"
+	"gopkg.in/jcmturner/gokrb5.v7/config"
+	"gopkg.in/jcmturner/gokrb5.v7/credentials"
+	"gopkg.in/jcmturner/gokrb5.v7/keytab"
+	"gopkg.in/jcmturner/gokrb5.v7/messages"
+	"gopkg.in/jcmturner/gokrb5.v7/spnego"
+	"gopkg.in/jcmturner/gokrb5.v7/types"
+)
+
+type krb5Auth struct {
+	username          string
+	realm             string
+	serverSPN         string
+	password          string
+	port              uint64
+	krb5ConfFile      string
+	krbFile           string
+	initkrbwithkeytab bool
+	krb5Client        *client.Client
+	state             krb5ClientState
+}
+
+var clientWithKeytab = client.NewClientWithKeytab
+var loadCCache = credentials.LoadCCache
+var clientFromCCache = client.NewClientFromCCache
+var spnegoNewNegToken = spnego.NewNegTokenInitKRB5
+var spnegoToken spnego.SPNEGOToken
+var spnegoUnmarshal = spnegoToken.Unmarshal
+var kt = &keytab.Keytab{}
+var ktUnmarshal = kt.Unmarshal
+
+var negTokenMarshal = func(negTok spnego.NegTokenInit) ([]byte, error) {
+	return negTok.Marshal()
+}
+var getServiceTicket = func(cl *client.Client, spn string) (messages.Ticket, types.EncryptionKey, error) {
+	return cl.GetServiceTicket(spn)
+}
+
+func getKRB5Auth(user, serverSPN, krb5Conf, krbFile, password string, initkrbwithkeytab bool) (auth, bool) {
+	var port uint64
+	var realm string
+	var serviceStr string
+	var err error
+
+	params1 := strings.Split(serverSPN, ":")
+	if len(params1) != 2 {
+		return nil, false
+	}
+
+	params2 := strings.Split(params1[1], "@")
+	switch len(params2) {
+	case 1:
+		port, err = strconv.ParseUint(params1[1], 10, 16)
+		if err != nil {
+			return nil, false
+		}
+	case 2:
+		port, err = strconv.ParseUint(params2[0], 10, 16)
+		if err != nil {
+			return nil, false
+		}
+	default:
+		return nil, false
+	}
+
+	params3 := strings.Split(serverSPN, "@")
+	switch len(params3) {
+	case 1:
+		serviceStr = params3[0]
+		params3 = strings.Split(params1[0], "/")
+		params3 = strings.Split(params3[1], ".")
+		realm = params3[1] + "." + params3[2]
+	case 2:
+		realm = params3[1]
+		serviceStr = params3[0]
+	default:
+		return nil, false
+	}
+
+	return &krb5Auth{
+		username:          user,
+		serverSPN:         serviceStr,
+		port:              port,
+		realm:             realm,
+		krb5ConfFile:      krb5Conf,
+		krbFile:           krbFile,
+		password:          password,
+		initkrbwithkeytab: initkrbwithkeytab,
+	}, true
+}
+
+func (auth *krb5Auth) InitialBytes() ([]byte, error) {
+	var err error
+	krb5CnfFile, err := os.Open(auth.krb5ConfFile)
+	if err != nil {
+		return []byte{}, err
+	}
+	c, err := config.NewConfigFromReader(krb5CnfFile)
+	if err != nil {
+		return []byte{}, err
+	}
+
+	// Set to lookup KDCs in DNS
+	c.LibDefaults.DNSLookupKDC = false
+
+	var cl *client.Client
+	// Init keytab from conf
+	if auth.initkrbwithkeytab {
+		keytabConf, err := ioutil.ReadFile(auth.krbFile)
+		if err != nil {
+			return []byte{}, err
+		}
+		if err = ktUnmarshal([]byte(keytabConf)); err != nil {
+			return []byte{}, err
+		}
+
+		// Init krb5 client and login
+		cl = clientWithKeytab(auth.username, auth.realm, kt, c, client.DisablePAFXFAST(true))
+
+	} else {
+		cache, err := loadCCache(auth.krbFile)
+		if err != nil {
+			return []byte{}, err
+		}
+
+		cl, err = clientFromCCache(cache, c)
+		if err != nil {
+			return []byte{}, err
+		}
+	}
+
+	auth.krb5Client = cl
+	auth.state = InitiatorStart
+
+	tkt, sessionKey, err := getServiceTicket(cl, auth.serverSPN)
+	if err != nil {
+		return []byte{}, err
+	}
+
+	negTok, err := spnegoNewNegToken(auth.krb5Client, tkt, sessionKey)
+	if err != nil {
+		return []byte{}, err
+	}
+
+	outToken, err := negTokenMarshal(negTok)
+	if err != nil {
+		return []byte{}, err
+	}
+	auth.state = InitiatorWaitForMutal
+	return outToken, nil
+}
+
+func (auth *krb5Auth) Free() {
+	auth.krb5Client.Destroy()
+}
+
+func (auth *krb5Auth) NextBytes(token []byte) ([]byte, error) {
+	if err := spnegoUnmarshal(token); err != nil {
+		err := fmt.Errorf("unmarshal APRep token failed: %w", err)
+		return []byte{}, err
+	}
+	auth.state = InitiatorReady
+	return []byte{}, nil
+}