Module gssapi 

GSSAPI/Kerberos authentication for EST endpoints.

Implements the Authorization: Negotiate (SPNEGO) authentication mechanism, following the same pattern as Akamu’s GSSAPI support.

When the gssapi feature is enabled, Kerberos tickets are cryptographically verified via the system’s GSS-API library (libgssapi crate wrapping libgssapi_krb5.so). Without the feature, only structural parsing of the SPNEGO token is available (extracting the service name from the cleartext ticket fields).

Channel binding to the TLS session (tls-server-end-point, RFC 5929) is supported to prevent credential forwarding attacks.

Structs

NegotiateOutToken

Request extension carrying the GSSAPI mutual-auth output token.

TlsChannelBinding

TLS channel binding data (tls-server-end-point, RFC 5929).

Functions

negotiate_challenge

Build a 401 response with a WWW-Authenticate: Negotiate challenge.

server_end_point

RFC5929 tls-server-end-point: hash the serving certificate using its signature hash, upgrading legacy MD5/SHA1 to SHA256.

try_extract_gssapi

Attempt to extract and validate GSSAPI/SPNEGO credentials.