Kerberos gives 401 - "authentication required"

[AlexanderRydberg]

Im stuck and need some help.

Unable to authenticate with my .net 8 console application to the vault with Kerberos. Need some pointers in the right direction and help to debug this.
This is the application (very simple one)

using VaultSharp;
using VaultSharp.V1.AuthMethods.Kerberos;
using VaultSharp.V1.AuthMethods;
using VaultSharp.Core;


IAuthMethodInfo authMethod = new KerberosAuthMethodInfo(); // uses network credential by default.
var vaultClientSettings = new VaultClientSettings("https://vault.example.com:8200", authMethod);

var httpHandler = new HttpClientHandler
{
    ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true
};

vaultClientSettings.MyHttpClientProviderFunc = handler => new HttpClient(httpHandler);

IVaultClient vaultClient = new VaultClient(vaultClientSettings);
vaultClient.V1.Auth.PerformImmediateLogin().GetAwaiter().GetResult();

Gives me this exception:

VaultSharp.Core.VaultApiException
  HResult=0x80131500
  Message={"errors":["authentication required"]}

  Source=VaultSharp
  StackTrace:
   at VaultSharp.Core.Polymath.<MakeRequestAsync>d__23`1.MoveNext() in C:\raja\gh\VaultSharp\src\VaultSharp\Core\Polymath.cs:line 309
   at VaultSharp.Core.Polymath.<MakeVaultApiRequest>d__21`1.MoveNext() in C:\raja\gh\VaultSharp\src\VaultSharp\Core\Polymath.cs:line 178
   at VaultSharp.V1.AuthMethods.Kerberos.KerberosAuthMethodLoginProvider.<GetVaultTokenAsync>d__3.MoveNext() in C:\raja\gh\VaultSharp\src\VaultSharp\V1\AuthMethods\Kerberos\KerberosAuthMethodLoginProvider.cs:line 25
   at VaultSharp.Core.Polymath.<PerformImmediateLogin>d__17.MoveNext() in C:\raja\gh\VaultSharp\src\VaultSharp\Core\Polymath.cs:line 126
   at VaultSharp.V1.AuthMethods.AuthMethodProvider.<PerformImmediateLogin>d__54.MoveNext() in C:\raja\gh\VaultSharp\src\VaultSharp\V1\AuthMethods\AuthMethodProvider.cs:line 92
   at Program.<Main>$(String[] args)

Tried var authMethod = new KerberosAuthMethodInfo(CredentialCache.DefaultCredentials); and var authMethod = new KerberosAuthMethodInfo(new NetworkCredential(userName, password)); : "authentication required".

If I run curl.exe in powershell, it works:
curl.exe --negotiate -X POST -u : https://vault.example.com:8200/v1/auth/kerberos/login -k

[AlexanderRydberg]

We could do this and it would work:

var vaultUrl = "https://vault.example.com:8200/v1/auth/kerberos/login"
var clientToken = await GetClientTokenAsync(vaultUrl);

var authMethod = new TokenAuthMethodInfo(clientToken);

var vaultClientSettings = new VaultClientSettings("https://vault.example.com:8200", authMethod);

rest of the code and then:

static async Task<string> GetClientTokenAsync(string url)
{
    using var httpClient = new HttpClient(new HttpClientHandler
    {
        UseDefaultCredentials = true,
        ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true
    });
    var request = new HttpRequestMessage(HttpMethod.Post, url);
    request.Headers.Add("Authorization", "Negotiate");

    var response = await httpClient.SendAsync(request);
    response.EnsureSuccessStatusCode();

    var content = await response.Content.ReadAsStringAsync();
    var json = System.Text.Json.JsonDocument.Parse(content);
    return json.RootElement.GetProperty("auth").GetProperty("client_token").GetString();
}

But thats not very pretty 😄

[rajanadar]

hi @AlexanderRydberg , couple of things.

• The default credentials used by KerberosAuthMethodInfo is not DefaultNetworkCredentials, it is DefaultCredentials.
• Also, VaultSharp sets the Kerberos creds in its HttpHandler initialization. Because you're providing your own HttpHandler for ssl success, you also need to set the kerberos part.

KerberosAuthMethodInfo authMethod = new KerberosAuthMethodInfo();  // uses DEFAULT credential by default.
var vaultClientSettings = new VaultClientSettings("https://vault.example.com:8200", authMethod);

var httpHandler = new HttpClientHandler
{
    ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true
};

httpHandler.PreAuthenticate = kerberosAuthMethodInfo.PreAuthenticate;
httpHandler.Credentials = kerberosAuthMethodInfo.Credentials; // or CredentialCache.DefaultNetworkCredentials;

vaultClientSettings.MyHttpClientProviderFunc = handler => new HttpClient(httpHandler);

[AlexanderRydberg]

Goddamnit 😆 Thank you! 🤦
even if I only add this UseDefaultCredentials = true, to the httphandler

using VaultSharp;
using VaultSharp.V1.AuthMethods.Kerberos;
using VaultSharp.V1.AuthMethods;

IAuthMethodInfo authMethod = new KerberosAuthMethodInfo(); // uses network credential by default.
var vaultClientSettings = new VaultClientSettings("https://vault.example.com:8200", authMethod);

var httpHandler = new HttpClientHandler
{
    UseDefaultCredentials = true,
    ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true
};

vaultClientSettings.MyHttpClientProviderFunc = handler => new HttpClient(httpHandler);

IVaultClient vaultClient = new VaultClient(vaultClientSettings);
vaultClient.V1.Auth.PerformImmediateLogin().GetAwaiter().GetResult();

It works.

Thank you again!