gokrb5

gokrb5 is a pure Go library implementing the Kerberos 5 network authentication protocol end to end — AS/TGS exchanges, keytab and credential-cache parsing, and Microsoft’s SPNEGO and PAC extensions — without linking against a native MIT or Heimdal krb5 library. It gives Go services and clients both sides of the authentication handshake: a client that logs in with a password or keytab and requests service tickets, and server-side HTTP middleware that validates SPNEGO Negotiate headers and decodes AD PAC authorization data.

Because the whole stack (ASN.1 encoding, cryptography, protocol messages) is implemented in Go rather than wrapped from a C library, gokrb5 cross-compiles cleanly and drops into containerized or CGO-disabled builds where a native Kerberos dependency would otherwise be a deployment headache.

What You Get

• Pure Go Kerberos 5 client for password- and keytab-based authentication with automatic TGT renewal
• SPNEGO-wrapped HTTP client and server middleware for Negotiate-based web authentication
• Keytab, krb5.conf, and credential-cache (ccache) file parsers
• Microsoft AD PAC authorization-data decoding exposed in the HTTP request context
• Support for modern AES/RC4 Kerberos encryption and checksum types (RFC 3961/3962/8009)

Common Use Cases

• Authenticating a Go HTTP client to an internal SPNEGO-protected service
• Adding Kerberos/AD login to a Go web server without depending on libkrb5
• Building custom Kerberos-aware tooling such as ticket inspection or keytab management
• Parsing and validating Microsoft AD PAC data for authorization decisions

Under The Hood

Architecture The codebase is layered by protocol concept rather than by application concern: low-level ASN.1/type packages (types, messages, asn1tools, iana) encode and decode the wire format defined by RFC 4120, crypto implements the encryption/checksum suites those messages reference, and config/keytab/credentials load the surrounding material (krb5.conf, keytab files, ccache). The client package composes these into the AS/TGS exchange flow (ASExchange.go, TGSExchange.go) plus a ticket/session cache, while spnego and service layer HTTP-specific behavior (Negotiate header handling, http.Handler middleware, AD PAC decoding) on top of that client. Nothing in the lower layers depends on the HTTP layer, so the protocol core is reusable outside of web contexts; changing a core abstraction like the ticket cache or an encryption type ripples predictably upward through client, then spnego/service, without touching the ASN.1 layer.

Tech Stack Written in Go (module targets Go 1.16+) with a deliberately thin dependency set: golang.org/x/crypto and golang.org/x/net for crypto/network primitives, gorilla/sessions for server-side session cookies in the SPNEGO HTTP middleware, hashicorp/go-uuid, stretchr/testify for testing, and a cluster of same-author companion modules (jcmturner/aescts, jcmturner/dnsutils, jcmturner/gofork, jcmturner/goidentity, jcmturner/rpc) that patch or extend the Go standard library’s ASN.1 and PBKDF2 handling where it can’t represent Kerberos’s wire format. There is no database, ORM, or web framework dependency — the library plugs into whatever HTTP stack the caller already uses.

Code Quality Test coverage is extensive and broad, with roughly 55 _test.go files spread across nearly every package using testify for assertions, including dedicated integration tests (client_integration_test.go, client_ad_integration_test.go, client_dns_test.go) that exercise real KDC/AD interaction rather than only mocks. Error handling is idiomatic Go — explicit error returns via errors.New/fmt.Errorf, plus a dedicated krberror package that carries structured Kerberos error codes through the call stack instead of swallowing them. GitHub Actions workflows (testingv8.yml, testing.yml) run the test suite in CI, and public APIs carry Go-doc comments throughout the sampled packages.

What Makes It Unique gokrb5’s differentiator is being a complete, faithful Kerberos 5 implementation with zero cgo or native library dependency — most Go Kerberos support otherwise comes from cgo bindings around MIT krb5 or Heimdal, which complicates cross-compilation and CGO_ENABLED=0/Alpine-style deployments. It goes beyond a bare protocol client by also decoding Microsoft’s AD-specific PAC authorization data and providing ready-made HTTP client/server SPNEGO wrappers, so it covers both ends of a Windows-domain-authenticated web exchange rather than leaving that integration work to the caller.