Skip to content

verify: live ADFS NTLM sign-in after go-ntlmssp v0.1.1 (NTLMv2 domain, Kerberos-only) #27

New issue
New issue
Open
Open
verify: live ADFS NTLM sign-in after go-ntlmssp v0.1.1 (NTLMv2 domain, Kerberos-only)#27
Labels
nature:securityConfidentiality, integrity or credential safetyprovider:adfspkg/provider/adfsseverity:S3Degraded, with an easy workaroundstatus:blockedBlocked on a named decision or test environmenttype:upliftToolchain, dependency, CI or platform currency

Description

@aspratt
aspratt
opened on Oct 20, 2026

Follow-up of #7 / PR #11.

Unit tests cover the handshake. What's left needs a real ADFS server with Windows integrated auth:

  • NTLMv2 hash domain handling (the domain from DOMAIN\user, and UPN)
  • Kerberos-only Negotiate challenges. v0.1.1 returns the original 401 for these, which is the same as the old pin; this is a known limitation
  • AllowBasicAuth with a Basic-only IdP

Blocked on test environment: an ADFS server.

Activity

  1. aspratt
    added
    type:upliftToolchain, dependency, CI or platform currency
    nature:securityConfidentiality, integrity or credential safety
    severity:S3Degraded, with an easy workaround
    provider:adfspkg/provider/adfs
    status:blockedBlocked on a named decision or test environment
    on Oct 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    nature:securityConfidentiality, integrity or credential safetyprovider:adfspkg/provider/adfsseverity:S3Degraded, with an easy workaroundstatus:blockedBlocked on a named decision or test environmenttype:upliftToolchain, dependency, CI or platform currency

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions