Implementing SPNEGO in Qt

Question

I've got a need to implement SPNEGO with a Qt client. The server responds with 401/Unauthorized and sends the WWW-Authenticate: Negotiate header.

Sohail Sohail · Accepted Answer · 2016-06-22T12:55:04

First, get a feel for the protocol through the RFC here: https://tools.ietf.org/html/rfc4559

Another great reference is https://github.com/requests/requests-kerberos

Understand that GSSAPI, while there is a cross-platform implementation, does not exist out of the box on Windows and instead you'll need to use SSPI. This answer will show how to implement it on Windows. You can map the functions onto GSSAPI for the other platforms. You will never write code like this for real, but I created this for people who need to implement SPNEGO without too much abstraction.

This example uses the fantastic Kerberos environment created here: https://github.com/Brandon-Godwin/vagrant-kerberos-environment

#include <QCoreApplication>
#include <QNetworkReply>
#include <QNetworkAccessManager>
#include <QtDebug>
#include <QNetworkReply>
#include <QAuthenticator>
#include <QNetworkRequest>
#include <QNetworkProxy>
#include <QNetworkCookieJar>
#include <QNetworkCookie>
#define SECURITY_WIN32
#include <windows.h>
#include <security.h>
#pragma comment(lib,"secur32.lib")

int main(int argc, char *argv[])
{
    QCoreApplication a(argc, argv);

    QNetworkAccessManager manager;

    manager.connect(&manager,&QNetworkAccessManager::authenticationRequired,
                    [](QNetworkReply * reply, QAuthenticator * authenticator) {
       qDebug() << "AUTH REQUIRED" << reply << authenticator;
    });


    manager.connect(&manager,&QNetworkAccessManager::proxyAuthenticationRequired,
                    [](const QNetworkProxy & proxy, QAuthenticator * authenticator) {
       qDebug() << "AUTH REQUIRED" << proxy << authenticator;
    });


    qDebug() << "RUNNING";

    QNetworkRequest request;
    request.setUrl(QUrl("http://dc.testdomain.lan:8080/hello"));

    auto reply = manager.get(request);
    reply->connect(reply,&QNetworkReply::finished,
                   [reply,request,&manager](){
        reply->deleteLater();
        if(reply->rawHeader("www-authenticate") == "Negotiate") {
            qDebug() << reply->rawHeaderList();
            qDebug() << reply->rawHeader("set-cookie");
            CredHandle cred = {0};
            TimeStamp exp;
            qDebug() << "Acquire"
                     << AcquireCredentialsHandleA(NULL,(LPSTR)"Kerberos",SECPKG_CRED_OUTBOUND,NULL,NULL,NULL,NULL,&cred,&exp);

            CtxtHandle ctx;
            SecBufferDesc outputBufferDesc;
            SecBuffer outputBuffers[1];
            outputBuffers[0].pvBuffer = NULL;
            outputBuffers[0].BufferType = SECBUFFER_TOKEN;
            outputBuffers[0].cbBuffer = 0;

            outputBufferDesc.ulVersion = SECBUFFER_VERSION;
            outputBufferDesc.cBuffers = 1;
            outputBufferDesc.pBuffers = outputBuffers;
            ULONG contextAttr;

            auto ret = InitializeSecurityContextA(&cred,NULL,(LPSTR)"HTTP/dc.testdomain.lan:8080",ISC_REQ_ALLOCATE_MEMORY,0,
                                                  SECURITY_NATIVE_DREP,NULL,0,&ctx,&outputBufferDesc,&contextAttr,&exp);
            // TODO: De-allocate outputBufferDesc.pBuffers[0]
#define CASE(X) case X: qDebug() << #X; return;
            switch(ret) {
            case SEC_E_OK:
                break;
            CASE(SEC_E_INSUFFICIENT_MEMORY);
            CASE(SEC_E_INTERNAL_ERROR);
            CASE(SEC_E_INVALID_HANDLE);
            CASE(SEC_E_INVALID_TOKEN);
            CASE(SEC_E_LOGON_DENIED);
            CASE(SEC_E_NO_AUTHENTICATING_AUTHORITY);
            CASE(SEC_E_NO_CREDENTIALS);
            CASE(SEC_E_TARGET_UNKNOWN);
            CASE(SEC_E_UNSUPPORTED_FUNCTION);
            CASE(SEC_E_WRONG_PRINCIPAL);
            default:
                qDebug() << "WAT" << ret;
                return;
            }

            auto pBuffer = outputBufferDesc.pBuffers[0];
            QByteArray array((const char *)pBuffer.pvBuffer,pBuffer.cbBuffer);
            QNetworkRequest request2 = request;
            request2.setRawHeader("Authorization","Negotiate " + array.toBase64());
            auto reply2 = manager.get(request2);
            reply2->connect(reply2,&QNetworkReply::finished,
                            [&manager,request,reply2]() {
                qDebug() << reply2->rawHeaderList();
                qDebug() << reply2->rawHeader("set-cookie");
                qDebug() << reply2->readAll();
                reply2->deleteLater();

                auto reply3 = manager.get(request);
                reply3->connect(reply3,&QNetworkReply::finished,
                                [reply3]() {
                    qDebug() << reply3->readAll();
                    qDebug() << reply3->rawHeaderList();
                    qDebug() << reply3->rawHeader("set-cookie");
                    reply3->deleteLater();
                });
            });

        }
    });

    return a.exec();
}

Implementing SPNEGO in Qt

2 Answers