/// <summary>
/// Checks there's a Kerberos Ticket in current user's Windows Ticket Cache matched with the service principal name.
/// If there's a valid ticket, then show the Ticket Information on the console.
/// </summary>
/// <returns></returns>
public bool ShowCachedTicket()
{
try
{
byte[] ticket
= KerberosSupplementalTicketManager.GetKerberosTicketFromWindowsTicketCache(_kerberosServicePrincipalName, _logonId);
if (ticket != null && ticket.Length > 32)
{
var encode = Convert.ToBase64String(ticket);
AADKerberosLogger.PrintLines(2);
AADKerberosLogger.Save($"---Find cached Ticket: {ticket.Length} bytes");
AADKerberosLogger.PrintBinaryData(ticket);
TicketDecoder decoder = new TicketDecoder();
decoder.ShowApReqTicket(encode);
return(true);
}
Console.WriteLine($"There's no ticket associated with '{_kerberosServicePrincipalName}'");
}
catch (Win32Exception ex)
{
Console.WriteLine($"ERROR while finding Kerberos Ticket for '{_kerberosServicePrincipalName}': {ex.Message}");
}
return(false);
}
/// <summary>
/// Validates Windows Ticket Cache interface for the given <see cref="KerberosSupplementalTicket"/> Kerberos Ticket.
/// </summary>
/// <param name="ticket">A <see cref="KerberosSupplementalTicket"/> object to be checked.</param>
public static void ValidateKerberosWindowsTicketCacheOperation(KerberosSupplementalTicket ticket)
{
if (DesktopOsHelper.IsWindows())
{
// First, save the given Kerberos Ticket (with KRB-CRED format) into the Windows Ticket Cache.
// Windows Ticket Cache decrypts the given Kerberos Ticket with KRB-CRED format, re-encrypt with it's
// credential and save it as AP-REQ format.
KerberosSupplementalTicketManager.SaveToWindowsTicketCache(ticket);
// Read-back saved Ticket data.
byte[] ticketBytes
= KerberosSupplementalTicketManager.GetKerberosTicketFromWindowsTicketCache(ticket.ServicePrincipalName);
Assert.IsNotNull(ticketBytes);
// To validate public field of AP-REQ format Kerberos Ticket, convert binary ticket data as a printable string format.
StringBuilder sb = new StringBuilder();
foreach (byte ch in ticketBytes)
{
if (ch >= 32 && ch < 127)
{
sb.Append((char)ch);
}
else
{
sb.Append('*');
}
}
string ticketAsString = sb.ToString();
// Check the Azure AD Kerberos Realm string exists.
Assert.IsTrue(ticketAsString.IndexOf(TestConstants.AzureADKerberosRealmName) >= 0);
// Check the ticket has matched Kerberos Service Principal Name.
Assert.IsTrue(ticketAsString.IndexOf(TestConstants.KerberosServicePrincipalNameEscaped, StringComparison.OrdinalIgnoreCase) >= 0);
}
}