Add Kerberos authentication support to SCCM mixin#21007
Open
erdragone430 wants to merge 2 commits intorapid7:masterfrom
Open
Add Kerberos authentication support to SCCM mixin#21007erdragone430 wants to merge 2 commits intorapid7:masterfrom
erdragone430 wants to merge 2 commits intorapid7:masterfrom
Conversation
743b9d0 to
8cae18f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This change adds support for Windows Authentication (Kerberos and NTLM) to the SCCM mixin.
Previously, the mixin methods
register_requestandget_secret_policiesdid not pass thepreferred_authoption tosend_request_raw. This caused SCCM modules to ignore the user-definedHTTP::Authsetting.I've updated the
optshash in the SCCM mixin to explicitly includepreferred_authsourced from the datastore. This allows modules likeget_naa_credentialsto work in environments requiring GSSAPI negotiation.Verification
List the steps needed to make sure this thing works:
msfconsoleuse auxiliary/admin/sccm/get_naa_credentialsset HTTP::Auth kerberosset HttpTrace truerun/ccm_system_windowsauth/request. (The_windowsauthsuffix confirms the mixin is now correctly passing the authentication requirement).Documentation
No new documentation is required as this uses existing HttpClient options.