Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for Windows Auth (Kerberos + NTLM) #43

Closed
wants to merge 1 commit into from

Conversation

jborean93
Copy link
Contributor

Adds support for sending emails with Windows authentication protocols Kerberos or NTLM. This is only supported on Windows hosts due to its reliance on Windows APIs. Currently it also embeds an edited NSspi assembly that has been changed to include support for the SASL mechanisms needed by SMTP.

This is not really in a merge able position at the moment. It includes a custom NSspi assembly as the latest on nuget does not support channel binding token support antiduh/nsspi#28 and the decryption mechanism will not work with how SASL requires it here. I've included a diff for the changes I've made to the assembly just to show what is needed on their end. The last commit made to that repository was in 2019 so I'm not sure if it's actively maintained (it may still be). Might be worth looking at different options here.

I've also switched up the parameter sets a bit more by including an -AuthType ... rather than a dedicated switch parameter for windows authentication. I didn't particularly want to add yet another parameter set to the parameters just for this feature but I'll let you decide on what you would like to do here.

Cross platform support could technically still be done but it's even more work. Ultimately the work that is required here is quite a lot and without a compiled build, it is not really feasible to do it in pwsh scripts.

Adds support for sending emails with Windows authentication protocols
Kerberos or NTLM. This is only supported on Windows hosts due to its
reliance on Windows APIs. Currently it also embeds an edited NSspi
assembly that has been changed to include support for the SASL
mechanisms needed by SMTP.
@PrzemyslawKlys
Copy link
Member

I've started rebuilding Mailozaurr in C#

I got it mostly working for SMTP sending, including signature/encryption with SMIME - I guess it should be easier now. It's not yet ready, but at least most code for SMTP is C# now.

PrzemyslawKlys added a commit that referenced this pull request May 16, 2024
- no need for #36
- maybe starting point for #43?
@jborean93
Copy link
Contributor Author

The code here works, it just required changes in the underlying NSSPI library (which seems to be dead) to achieve. The SASL used with Kerberos needs to sign the payload after the auth which the NTLM one does not need to do. This is why you were able to do it there. I'll eventually get back to my GSSAPI/SSPI C# library but it's sitting in a pretty big TODO pile right now :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants