diff options
| author | Aaron Klotz <aaron@tailscale.com> | 2024-06-05 14:50:18 -0600 |
|---|---|---|
| committer | Aaron Klotz <aaron@tailscale.com> | 2024-06-25 22:05:52 -0600 |
| commit | da078b4c09993c3df4f7838e534fa92a2acba2e2 (patch) | |
| tree | 55cf3639db545faedddd5903cbde11efc35c65b0 /control/controlknobs | |
| parent | 53a5d00fffca113d9ea21c91cbb9634d2528b074 (diff) | |
| download | tailscale-da078b4c09993c3df4f7838e534fa92a2acba2e2.tar.xz tailscale-da078b4c09993c3df4f7838e534fa92a2acba2e2.zip | |
util/winutil: add package for logging into Windows via Service-for-User (S4U)
This PR ties together pseudoconsoles, user profiles, s4u logons, and
process creation into what is (hopefully) a simple API for various
Tailscale services to obtain Windows access tokens without requiring
knowledge of any Windows passwords. It works both for domain-joined
machines (Kerberos) and non-domain-joined machines. The former case
is fairly straightforward as it is fully documented. OTOH, the latter
case is not documented, though it is fully defined in the C headers in
the Windows SDK. The documentation blanks were filled in by reading
the source code of Microsoft's Win32 port of OpenSSH.
We need to do a bit of acrobatics to make conpty work correctly while
creating a child process with an s4u token; see the doc comments above
startProcessInternal for details.
Updates #12383
Signed-off-by: Aaron Klotz <aaron@tailscale.com>
Diffstat (limited to 'control/controlknobs')
0 files changed, 0 insertions, 0 deletions