[cifs-protocol] [MS-KILE] Certificate strings - but nothing is said as to how these strings are to be derived from the client’s certificate - TrackingID#2308180010001826

[Joseph Sutton]

Hi,

I have not managed to have Windows generate these certificate strings 
myself, but I imagine the procedure looks something like the following.

First, create a claim type like so:

dn: CN=ExampleClaim,CN=Claim Types,CN=Claims
   Configuration,CN=Services,CN=Configuration,DC=example,DC=com
changetype: add
objectClass: msDS-ClaimType
Enabled: TRUE
msDS-ClaimIsSingleValued: TRUE
msDS-ClaimSource: (what value should this have? — see below.)
msDS-ClaimSourceType: Certificate
msDS-ClaimTypeAppliesToClass:
   CN=User,CN=Schema,CN=Configuration,DC=example,DC=com
msDS-ClaimTypeAppliesToClass:
   CN=Computer,CN=Schema,CN=Configuration,DC=example,DC=com
msDS-ClaimValueType: 6

Then, having installed and set up Certificate Services on the Windows 
server, perform a Kerberos AS-REQ using PKINIT. If the KDC generates the 
certificate strings as specified in [MS-ADTS], the claim ought now to be 
in the PAC_CLIENT_CLAIMS_INFO PAC buffer in the TGT. More pertinently 
(from an end user’s perspective), with the claim in the PAC we should be 
authorized to access resources requiring possession of said claim.

I’ve followed these steps as far as making the Kerberos AS-REQ.

The part of all this that I’m quite uncertain about is how to set the 
attribute “msDS-ClaimSource”. According to the documentation for 
GetCertificateSourcedClaims() ([MS-ADTS] section 3.1.1.11.2.3), a 
certificate-sourced claim will be issued only if this attribute matches 
one of the certificate strings. But, as of yet, I haven’t been able to 
discover what value this attribute should hold for that to happen, not 
knowing how the certificate strings are derived. That’s what I’m 
ultimately trying to find out.

Regards,
Joseph

On 22/08/23 6:23 am, Jeff McCashland (He/him) wrote:
> Hi Joseph,
> 
> I think I will need to do some debugging to find the answer to your question. Do you have a use case or scenario that would use this mechanism? Can you suggest a configuration and repro steps I can use to generate the exchange?
> 
> Best regards,
> Jeff McCashland (He/him) | Senior Escalation Engineer | Microsoft Protocol Open Specifications Team
> Phone: +1 (425) 703-8300 x38300 | Hours: 9am-5pm | Time zone: (UTC-08:00) Pacific Time (US and Canada)
> Local country phone number found here: http://support.microsoft.com/globalenglish | Extension 1138300
> 
> -----Original Message-----
> From: Jeff McCashland (He/him)
> Sent: Friday, August 18, 2023 9:52 AM
> To: Joseph Sutton <jsutton at samba.org>; cifs-protocol at lists.samba.org
> Cc: Microsoft Support <supportmail at microsoft.com>
> Subject: RE: [MS-KILE] Certificate strings - but nothing is said as to how these strings are to be derived from the client’s certificate - TrackingID#2308180010001826
> 
> [HC to BCC]
> 
> Hi Joseph,
> 
> I will research your question and let you know what I find.
> 
> Best regards,
> Jeff McCashland (He/him) | Senior Escalation Engineer | Microsoft Protocol Open Specifications Team
> Phone: +1 (425) 703-8300 x38300 | Hours: 9am-5pm | Time zone: (UTC-08:00) Pacific Time (US and Canada) Local country phone number found here: http://support.microsoft.com/globalenglish | Extension 1138300
> 
> -----Original Message-----
> From: Hung-Chun Yu <HungChun.Yu at microsoft.com>
> Sent: Thursday, August 17, 2023 9:44 PM
> To: Joseph Sutton <jsutton at samba.org>; cifs-protocol at lists.samba.org
> Cc: Microsoft Support <supportmail at microsoft.com>; Hung-Chun Yu <HungChun.Yu at microsoft.com>
> Subject: [MS-KILE] Certificate strings - but nothing is said as to how these strings are to be derived from the client’s certificate - TrackingID#2308180010001826
> 
> [bcc dochelp]
> Hi Joseph
> 
> Thank you for contacting Protocol Support. We created SR Case - TrackingID#2308180010001826. Do leave this tag in the subject line for future references.
> One of our engineers will be contacting you shortly.
> 
> Hung-Chun Yu
> hunyu at microsoft.com
> 
> -----Original Message-----
> From: Joseph Sutton <jsutton at samba.org>
> Sent: Thursday, August 17, 2023 7:26 PM
> To: cifs-protocol at lists.samba.org; Interoperability Documentation Help <dochelp at microsoft.com>
> Subject: [EXTERNAL] [MS-KILE] Certificate strings
> 
> [Some people who received this message don't often get email from jsutton at samba.org. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> Hi dochelp,
> 
> [MS-KILE] 3.3.5.6.4.6, “PAC_CLIENT_CLAIMS_INFO Structure”, mentions that the KDC should call GetClaimsForPrincipal() to get the claims blob with which to populate the PAC_CLIENT_CLAIMS_INFO structure. One of the parameters to GetClaimsForPrincipal(), namely “pCertificateStringsArray”, comprises “[a] set of Unicode strings”, but nothing is said as to how these strings are to be derived from the client’s certificate.
> 
> Can you outline the procedure by which these strings are formed, and perhaps provide an example of such a string?
> 
> Regards,
> Joseph
>