[cifs-protocol] [MS-KILE] Certificate strings - but nothing is said as to how these strings are to be derived from the client’s certificate - TrackingID#2308180010001826

[Jeff McCashland (He/him)]

Hi Joseph,

I think I will need to do some debugging to find the answer to your question. Do you have a use case or scenario that would use this mechanism? Can you suggest a configuration and repro steps I can use to generate the exchange? 

Best regards,
Jeff McCashland (He/him) | Senior Escalation Engineer | Microsoft Protocol Open Specifications Team
Phone: +1 (425) 703-8300 x38300 | Hours: 9am-5pm | Time zone: (UTC-08:00) Pacific Time (US and Canada)
Local country phone number found here: http://support.microsoft.com/globalenglish | Extension 1138300

-----Original Message-----
From: Jeff McCashland (He/him) 
Sent: Friday, August 18, 2023 9:52 AM
To: Joseph Sutton <jsutton at samba.org>; cifs-protocol at lists.samba.org
Cc: Microsoft Support <supportmail at microsoft.com>
Subject: RE: [MS-KILE] Certificate strings - but nothing is said as to how these strings are to be derived from the client’s certificate - TrackingID#2308180010001826

[HC to BCC]

Hi Joseph,

I will research your question and let you know what I find. 

Best regards,
Jeff McCashland (He/him) | Senior Escalation Engineer | Microsoft Protocol Open Specifications Team
Phone: +1 (425) 703-8300 x38300 | Hours: 9am-5pm | Time zone: (UTC-08:00) Pacific Time (US and Canada) Local country phone number found here: http://support.microsoft.com/globalenglish | Extension 1138300

-----Original Message-----
From: Hung-Chun Yu <HungChun.Yu at microsoft.com>
Sent: Thursday, August 17, 2023 9:44 PM
To: Joseph Sutton <jsutton at samba.org>; cifs-protocol at lists.samba.org
Cc: Microsoft Support <supportmail at microsoft.com>; Hung-Chun Yu <HungChun.Yu at microsoft.com>
Subject: [MS-KILE] Certificate strings - but nothing is said as to how these strings are to be derived from the client’s certificate - TrackingID#2308180010001826

[bcc dochelp]
Hi Joseph

Thank you for contacting Protocol Support. We created SR Case - TrackingID#2308180010001826. Do leave this tag in the subject line for future references.
One of our engineers will be contacting you shortly.

Hung-Chun Yu
hunyu at microsoft.com

-----Original Message-----
From: Joseph Sutton <jsutton at samba.org>
Sent: Thursday, August 17, 2023 7:26 PM
To: cifs-protocol at lists.samba.org; Interoperability Documentation Help <dochelp at microsoft.com>
Subject: [EXTERNAL] [MS-KILE] Certificate strings

[Some people who received this message don't often get email from jsutton at samba.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

Hi dochelp,

[MS-KILE] 3.3.5.6.4.6, “PAC_CLIENT_CLAIMS_INFO Structure”, mentions that the KDC should call GetClaimsForPrincipal() to get the claims blob with which to populate the PAC_CLIENT_CLAIMS_INFO structure. One of the parameters to GetClaimsForPrincipal(), namely “pCertificateStringsArray”, comprises “[a] set of Unicode strings”, but nothing is said as to how these strings are to be derived from the client’s certificate.

Can you outline the procedure by which these strings are formed, and perhaps provide an example of such a string?

Regards,
Joseph