feat(picky-krb): add IAKerb proxy message encoding/decoding by Rostyslav-Romanets · Pull Request #531 · Devolutions/picky-rs

Rostyslav-Romanets · 2026-09-24T14:42:36Z

This PR implements encoding and decoding of the IAKERB_PROXY message (IAKrbProxyMessage) according to the IAKERB specification. The implementation is also covered with unit-tests.

What is IAKERB

IAKERB extends Kerberos to support scenarios where the client cannot directly access the KDC. Instead, KDC messages are encapsulated in GSS-API tokens and exchanged through an IAKERB proxy. The server forwards these messages to the LocalKDC, allowing the client to obtain the required Kerberos tickets without direct network access to the KDC.

Microsoft recently introduced IAKERB support in Windows Insider builds as part of its effort to reduce NTLM dependency: https://techcommunity.microsoft.com/blog/windows-itpro-blog/reducing-ntlm-dependency-iakerb-and-localkdc-in-windows-insider-preview/4524615.

Related PRs

Copilot

Copilot review overview

🟡 Changes recommended

Decoding does not enforce outer framing boundaries or handle valid unknown header extensions.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1 · 1

Open (3)

Enforce outer application payload length and exact consumption · New
Handle extensible IAKERB header fields before decoding krb_msg · New
Correct misspelled protocol token name to IAKERB_PROXY · New

What changed in this PR

Adds IAKERB proxy message support for downstream Kerberos proxy integrations.

Changes:

Adds IAKERB headers, constants, error codes, and mechanism OID.
Implements proxy message encoding/decoding.
Adds DER round-trip tests.

File	Description
`picky-krb/src/messages.rs`	Defines the IAKERB header and tests.
`picky-krb/src/gss_api.rs`	Implements proxy token encoding and decoding.
`picky-krb/src/constants.rs`	Adds IAKERB token and error constants.
`picky-asn1-x509/src/oids.rs`	Registers the IAKERB mechanism OID.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot

Copilot review overview

🟡 Changes recommended

Malformed known optional header fields can be silently accepted as absent.

Review effort: Balanced
Findings: 1

Open (1)

Malformed known optional fields are silently ignored during header parsing · New

Resolved since last review (3)

Enforce outer application payload length and exact consumption
Handle extensible IAKERB header fields before decoding krb_msg
Correct misspelled protocol token name to IAKERB_PROXY

Rostyslav-Romanets · 2026-09-28T13:08:18Z

+        let Asn1RawDer(raw) = Asn1RawDer::deserialize(deserializer)?;
+        let IAKerbHeaderHelper {
+            target_realm,
+            cookie,
+            flags,
+        } = picky_asn1_der::from_bytes(&raw)
+            .map_err(|err| D::Error::custom(format!("Cannot deserialize IAKerbHeader: {err:?}")))?;


Parse the sequence by tag instead, propagating errors for known [2]/[3] fields and skipping only genuinely unknown extension tags.

This requires manual deserialization implementation. I don't think that's a good idea.
It would be better to fix the Optional type so that it returns an error if a value is present but malformed. But this should be done in a separate PR, since it touches many structures.

Indeed. I think that the picky-asn1-der abstractions are not very good, and I’m considering a migration to the der crate instead of using serde for what it’s not good at. For now, I’ll merge as is, but I would gladly accept separate PRs to improve this. Thanks!

Benoît Cortier (CBenoit)

Thank you for contributing this. LGTM!

Benoît Cortier (CBenoit) · 2026-09-29T08:50:21Z

Looks like merge is blocked on the code formatting, can you just run cargo fmt, please? Thank you.

picky-krb 0.12.5 (#531) added `GssApiMessageError::InvalidMechanismOid` to an exhaustive public enum in a patch release. That is a semver-breaking change. Every published `sspi` (0.21.x, 0.22.x, 0.23.0) matches this enum exhaustively, so none of them compile against 0.12.5 (`error[E0004]: non-exhaustive patterns`). This broke fresh dependency resolves downstream, for example in IronRDP. 0.12.5 will be yanked manually on crates.io. This PR re-releases the same code as **0.13.0**. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…751) This PR adds support for the IAKERB extension according to the [IAKERB specification](https://datatracker.ietf.org/doc/html/draft-ietf-kitten-iakerb-03). The main changes are focused on the `Kerberos` state machine. Previously, the `Preauthentication` state handled the entire KDC message exchange withing a single async `intialize_security_context` call. This approach does not work with IAKERB, where KDC messages are exchanged via a server that acts as a proxy. The `Preauthentication` state has therefore been split into multiple states, allowing the state machine to save `Kerberos` state between KDC message exchanges. Additionaly, the `AS` and `TGS` exchanges have been extracted into separate state machines. These new state machines are KDC transport-agnostic and can be used with both external KDC and an IAKERB proxy. ## What is IAKERB IAKERB extends Kerberos to support scenarios where the client cannot directly access the KDC. Instead, KDC messages are encapsulated in GSS-API tokens and exchanged through an IAKERB proxy. The server forwards these messages to the LocalKDC, allowing the client to obtain the required Kerberos tickets without direct network access to the KDC. Microsoft recently introduced IAKERB support in Windows Insider builds as part of its effort to reduce NTLM dependency: https://techcommunity.microsoft.com/blog/windows-itpro-blog/reducing-ntlm-dependency-iakerb-and-localkdc-in-windows-insider-preview/4524615. ## Related PRs * picky-rs: Devolutions/picky-rs#531 * IronRDP: Devolutions/IronRDP#1987

feat(picky-krb): add IAKerb proxy message

f37a2d3

Rostyslav-Romanets marked this pull request as draft September 24, 2026 14:46

This was referenced Sep 24, 2026

feat(kerberos): add support for IAKerb extension for Kerberos client Devolutions/sspi-rs#751

Merged

feat(credssp): use the KdcResolution enum instead of KDC url Devolutions/IronRDP#1987

Merged

Rostyslav-Romanets marked this pull request as ready for review September 24, 2026 15:44

Marc-André Moreau (mamoreau-devolutions) requested a balanced review from Copilot September 25, 2026 19:50

Copilot started reviewing on behalf of Marc-André Moreau (mamoreau-devolutions) September 25, 2026 19:50

View session

Copilot AI reviewed Sep 25, 2026

View reviewed changes

Comment thread picky-krb/src/gss_api.rs Resolved

Comment thread picky-krb/src/messages.rs Resolved

Comment thread picky-krb/src/messages.rs Resolved

refactor(picky-krb): apply code review suggestions from Copilot

a856b05

Rostyslav-Romanets requested a balanced review from Copilot September 28, 2026 12:07

Copilot started reviewing on behalf of Rostyslav-Romanets September 28, 2026 12:08

View session

Copilot AI reviewed Sep 28, 2026

View reviewed changes

Benoît Cortier (CBenoit) approved these changes Sep 29, 2026

View reviewed changes

style: run cargo fmt

c7d0de1

Rostyslav-Romanets requested a review from Benoît Cortier (CBenoit) September 29, 2026 09:51

Benoît Cortier (CBenoit) enabled auto-merge (squash) September 29, 2026 15:03

Benoît Cortier (CBenoit) merged commit 6f98044 into Devolutions:master Sep 29, 2026
12 checks passed

This was referenced Sep 29, 2026

chore(release): prepare for publishing #521

Merged

chore(release): prepare for publishing #543

Merged

Benoît Cortier (CBenoit) mentioned this pull request Oct 7, 2026

chore(release): re-release picky-krb 0.12.5 as 0.13.0 #549

Merged

Navigation Menu

Repository navigation

feat(picky-krb): add IAKerb proxy message encoding/decoding - #531

feat(picky-krb): add IAKerb proxy message encoding/decoding#531
Benoît Cortier (CBenoit) merged 3 commits into
Devolutions:masterfrom
Rostyslav-Romanets:add-iakerb-messages

Rostyslav-Romanets commented Sep 24, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Rostyslav-Romanets Sep 28, 2026 •

edited

Loading

Uh oh!

Benoît Cortier (CBenoit) Sep 29, 2026 •

edited

Loading

Uh oh!

Benoît Cortier (CBenoit) left a comment

Uh oh!

Benoît Cortier (CBenoit) commented Sep 29, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Conversation

Rostyslav-Romanets commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What is IAKERB

Related PRs

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Rostyslav-Romanets Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Benoît Cortier (CBenoit) Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Benoît Cortier (CBenoit) left a comment

Choose a reason for hiding this comment

Uh oh!

Benoît Cortier (CBenoit) commented Sep 29, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Rostyslav-Romanets commented Sep 24, 2026 •

edited

Loading

Rostyslav-Romanets Sep 28, 2026 •

edited

Loading

Benoît Cortier (CBenoit) Sep 29, 2026 •

edited

Loading