krb5test

README

krb5test

This project provides a mock Kerberos Domain Controller (KDC) suitable for testing.

The mock KDC does not provide all KDC funcationality but it does cover the basics of:

• Responding to the initial login to obtain a TGT via an AS exchange
• Granting a service ticket in response to a TGS exchange

Usage

1. Create a logger that the KDC will log to:

l := log.New(os.Stderr, "KDC Test Server: ", log.LstdFlags)

1. Create a map of principals (both user and service principals). The keys of the map are the principal names and the values are the groups each is a member of.

p := make(map[string][]string)
p["testuser1"] = []string{"testgroup1"}
p["HTTP/host.test.realm.com"] = []string{}

1. Create the KDC test instance:

kdc, err := NewKDC(p, l)

1. Start the KDC server and defer its closure:

kdc.Start()
defer kdc.Close()

The KDC dynamically creates credentials for the principals specified. These can be accessed in the form of a keytab from the KDC:

kdc.Keytab

A krb5.conf that can be used for a client can also be obtained from the KDC instance:

kdc.KRB5Conf

The KDC instance will dynamically pick available ports to use on localhost. Use of this krb5.conf will automatically wire up any client to use this connection.

The Realm name used is also available from the KDC instance:

kdc.Realm

Documentation

Index

• type KDC
  • func NewKDC(principals map[string][]string, l *log.Logger) (*KDC, error)
  • func (k *KDC) Close()
  • func (k *KDC) Start()
• type PrincipalDetails

Types

type KDC

type KDC struct {
	Realm      string
	KRB5Conf   *config.Config
	SName      types.PrincipalName
	Principals map[string]PrincipalDetails
	Keytab     *keytab.Keytab
	Logger     *log.Logger

	TCPListener net.Listener
	UDPListener net.PacketConn
	// contains filtered or unexported fields
}

func NewKDC

func NewKDC(principals map[string][]string, l *log.Logger) (*KDC, error)

func (*KDC) Close

func (k *KDC) Close()

func (*KDC) Start

func (k *KDC) Start()

type PrincipalDetails

type PrincipalDetails struct {
	Password string
	Groups   []string
	Client   *client.Client
}