RUST-2245 Implement GSSAPI auth support for Windows #1444

mattChiaravalloti · 2025-08-06T19:27:42Z

This PR implements GSSAPI auth support for Windows as described by the spec. Similar to the Linux and Mac implementation in #1413, this one took longer than expected. In the end, it turned out that the sspi crate was not as amenable to this task as initially thought at scope time. I decided to attempt to implement this using the native Windows api (via windows-sys) and modeling it exactly off of libmongoc since I know the C implementation works. Of course, that results in a bit more C-style code than Rust-style code, but after several weeks of investigating and implementing, this is finally working.

I updated the GSSAPI codepath to share common code between Linux/Mac and Windows as much as possible. I only separated out the platform-specific implementations and guarded each with the relevant cfg attributes.

This PR also updates the e2e tests to run on Windows. I observed this implementation passing my local testing on a Windows host, and the e2e tests passing on this patch. I anticipate the evergreen patch associated with this PR to succeed off the bat, as well.

…f sspi

…ames

codeowners-service-app · 2025-08-06T19:28:11Z

Assigned rishitb-mongodb for team dbx-rust because abr-egn is out of office.

mattChiaravalloti · 2025-08-06T19:29:12Z

.evergreen/config.yml

@@ -1405,7 +1413,7 @@ functions:
      type: test
      params:
        binary: bash
-        working_dir: ${PROJECT_DIRECTORY}
+        working_dir: src


Using ${PROJECT_DIRECTORY} on windows-64-vs2017-small was causing "working_dir could not be found" errors. I checked the rest of config.yml and it seems like the majority of working_dir values are set to src. I only chose ${PROJECT_DIRECTORY} initially since I based this function on the aws auth functions.

.evergreen/run-gssapi-tests.sh

mattChiaravalloti · 2025-08-06T19:30:25Z

Cargo.toml

@@ -235,6 +234,13 @@ features = ["serde", "serde_json-1"]
 rustdoc-args = ["--cfg", "docsrs"]
 all-features = true

+# Target-specific dependencies for GSSAPI authentication


To be honest, I've never had to do this before in a Cargo.toml file so I'm not sure if this is the idiomatic way.

mattChiaravalloti · 2025-08-06T19:31:54Z

src/client/auth/gssapi/mod.rs

    let source = credential.source.as_deref().unwrap_or("$external");

+    #[cfg(target_os = "windows")]
+    let (mut authenticator, initial_token) = windows::SspiAuthenticator::init(


As you see in the windows.rs file, I created the SspiAuthenticator struct to mirror the GssapiAuthenticator struct. It has the same interface (although I did not go so far as to make them both implement a common trait since they'll never be compiled together). This allowed the core authentication steps in this function to remain unchanged.

src/client/auth/gssapi/mod.rs

mattChiaravalloti · 2025-08-06T19:34:04Z

src/client/auth/gssapi/nix.rs

@@ -0,0 +1,108 @@
+use cross_krb5::{ClientCtx, InitiateFlags, K5Ctx, PendingClientCtx, Step};


This file is essentially just cut-pasted from the original gssapi.rs file. The only notable change is a minor tweak to the function signatures: they are no longer marked as async since that is not required. I left that in basically by accident after doing all the refactoring and trial-and-erroring the first time around.

mattChiaravalloti · 2025-08-06T19:38:19Z

src/client/auth/gssapi/windows.rs

+    user_principal: String,
+}
+
+impl SspiAuthenticator {


This is the core implementation for the SSPI auth protocol on Windows. It is based heavily on the C implementation. I truly tried (for weeks) to get a higher level, more Rust-like library to work first. At the end of the day, though, the best way to do this was to resort to the low-level Windows API. It is a bit harder to read, but fortunately the SSPI api is not something that changes often (or will/should change in the future). The C implementation has been largely untouched for years and it still works!

I'm going to have to defer to @kevinAlbs to review the actual semantics of the implementation here :)

mattChiaravalloti · 2025-08-06T19:40:24Z

src/client/auth/gssapi/windows.rs

+    }
+}
+
+impl Drop for SspiAuthenticator {


Required since these handles are set and used basically exclusively in unsafe blocks.

mattChiaravalloti · 2025-08-06T19:50:07Z

Is it possible to make exceptions to the semgrep policy to allow for the use of these unsafe blocks, or will we need to get rid of them?

mattChiaravalloti · 2025-08-07T14:27:32Z

Is it possible to make exceptions to the semgrep policy to allow for the use of these unsafe blocks, or will we need to get rid of them?

I investigated further and am not confident SSPI support can be implemented the way our drivers require if we do not use these unsafe blocks.

There are limited crate options for kerberos auth. We've ruled out libgssapi-sys/libgssapi/cross-krb5 since they rely on MIT KRB5. I discovered sspi is insufficient for our needs (it is incapable of producing the token types needed for MongoDB's SASL auth flow when using GSSAPI). Looking through crates.io, there are not any other viable candidates for this, so the windows crate is likely our best option.

Using the native Windows API inherently requires unsafe code. Hopefully we can make an exception for this. I know in the ODBC driver, we have some required unsafe code that is permitted.

abr-egn · 2025-08-07T14:46:45Z

Is it possible to make exceptions to the semgrep policy to allow for the use of these unsafe blocks, or will we need to get rid of them?

I investigated further and am not confident SSPI support can be implemented the way our drivers require if we do not use these unsafe blocks.

There are limited crate options for kerberos auth. We've ruled out libgssapi-sys/libgssapi/cross-krb5 since they rely on MIT KRB5. I discovered sspi is insufficient for our needs (it is incapable of producing the token types needed for MongoDB's SASL auth flow when using GSSAPI). Looking through crates.io, there are not any other viable candidates for this, so the windows crate is likely our best option.

Using the native Windows API inherently requires unsafe code. Hopefully we can make an exception for this. I know in the ODBC driver, we have some required unsafe code that is permitted.

I haven't had the chance to look into this PR in detail, but it should work to use a nosemgrep comment, we've had to do that in a couple other places in the code base (example). My recollection of the policy (I'll verify later) is that as long as we've investigated and have manually validated that the thing semgrep would complain about is not, in fact, a problem it's fine.

abr-egn · 2025-08-08T14:39:48Z

src/client/auth/gssapi/nix.rs

+    error::{Error, Result},
+};
+
+pub(super) struct GssapiAuthenticator {


Not changed in this PR, but this being a fresh file made me realize - this is only ever either

GssapiAuthenticator { pending_ctx: Some(...), established_ctx: None, is_complete: false, ... }

or

GssapiAuthenticator { pending_ctx: None, established_ctx: Some(...), is_complete: true, ... }

right? That seems like it would be better modeled via a state enum, e.g.

enum CtxState { Pending(PendingClientCtx), Established(ClientCtx), } pub(super) struct GssapiAuthenticator { ctx: CtxState, user_principal: String, }

Ah that's a nice refactor. I'll make this change.

abr-egn · 2025-08-08T14:52:49Z

src/client/auth/gssapi/windows.rs

+    }
+
+    fn acquire_credentials_and_init(&mut self, password: Option<String>) -> Result<Vec<u8>> {
+        unsafe {


I believe the only unsafe portion of this is calling AcquireCredentialsHandleW, right? I'd rather see the unsafe blocks as narrowly scoped as possible.

Good point! I started broad to allow for whatever had to be done, but I'll narrow these down now like you suggested 👍

abr-egn · 2025-08-08T14:55:47Z

src/client/auth/gssapi/windows.rs

+    user_principal: String,
+}
+
+impl SspiAuthenticator {


I'm going to have to defer to @kevinAlbs to review the actual semantics of the implementation here :)

pmeredit · 2025-08-08T19:44:29Z

src/client/auth/gssapi/nix.rs

+
+    // Perform the final step of Kerberos authentication by gss_unwrap-ing the
+    // final server challenge, then wrapping the protocol bytes + user principal.
+    // The resulting token must be sent to the server.


This is like a monad transformer 😂

isabelatkinson

one tiny comment, I did a pass over the C-style code but will similarly defer to @kevinAlbs on the details

isabelatkinson · 2025-08-11T21:55:20Z

src/client/auth/gssapi/mod.rs

This filename should be able to stay the same - we stopped using mod.rs files a while ago (https://doc.rust-lang.org/reference/items/modules.html#module-source-filenames)

mattChiaravalloti added 13 commits July 29, 2025 15:03

RUST-2245: Fix typo in e2e test logging

fe75d16

RUST-2245: Initial second attempt at GSSAPI on Windows

9dda3b3

RUST-2245: Refactor service_principal name creation

4186779

RUST-2245: Separate windows and non-windows implementations

3cf15d0

RUST-2245: Update windows implementation to use windows api instead o…

9175eb2

…f sspi

Merge branch 'main' into RUST-2245

f95788b

RUST-2245: Fix rustfmt

08ca68a

RUST-2245: Refactor to share more common code

0d6858b

RUST-2245: Standardize requirement of user_principal and use better n…

56661ab

…ames

RUST-2245: More clean up, refactoring, and renaming

a32a408

RUST-2245: Static analysis fixes

6bb9227

RUST-2245: Update e2e tests to handle windows

6654548

RUST-2245: Fix evergreen tasks

9a3ffa8

mattChiaravalloti requested a review from a team as a code owner August 6, 2025 19:27

mattChiaravalloti requested a review from abr-egn August 6, 2025 19:27

codeowners-service-app bot requested a review from rishitb-mongodb August 6, 2025 19:28

mattChiaravalloti commented Aug 6, 2025

View reviewed changes

mattChiaravalloti requested review from isabelatkinson and removed request for rishitb-mongodb August 6, 2025 19:40

RUST-2245: Add more comments

726e9f8

abr-egn requested a review from kevinAlbs August 8, 2025 14:54

abr-egn reviewed Aug 8, 2025

View reviewed changes

mattChiaravalloti requested a review from pmeredit August 8, 2025 17:16

pmeredit reviewed Aug 8, 2025

View reviewed changes

mattChiaravalloti added 2 commits August 8, 2025 15:52

RUST-2245: Reduce unsafe to smaller scopes, add nosemgrep comments

51c98bc

RUST-2245: Refactor GssapiAuthenticator

71b3f68

mattChiaravalloti removed the request for review from isabelatkinson August 8, 2025 20:12

isabelatkinson reviewed Aug 11, 2025

View reviewed changes

		@@ -0,0 +1,108 @@
		use cross_krb5::{ClientCtx, InitiateFlags, K5Ctx, PendingClientCtx, Step};

RUST-2245 Implement GSSAPI auth support for Windows #1444

Are you sure you want to change the base?

RUST-2245 Implement GSSAPI auth support for Windows #1444

Conversation

mattChiaravalloti commented Aug 6, 2025

Uh oh!

codeowners-service-app bot commented Aug 6, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mattChiaravalloti Aug 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mattChiaravalloti commented Aug 6, 2025

Uh oh!

mattChiaravalloti commented Aug 7, 2025

Uh oh!

abr-egn commented Aug 7, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

isabelatkinson left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mattChiaravalloti Aug 6, 2025 •

edited

Loading