CRAFT Certificate Request Agent for Tickets

CRAFT is a versatile Kerberos credential solution for Linux, including hosts that are not domain-joined. Administrators select and order one or more operating modes to fit their environment's PKI, directory capabilities and application needs. Three modes use certificate authentication (PKINIT) to obtain a user's ticket-granting ticket (TGT); a fourth uses broker-account constrained delegation to obtain selected service tickets. CRAFT publishes a private cache for unattended scripts and Kerberos-aware applications without storing the user's Active Directory password.

Choose operating modes

Mode	Credential and authorization	Linux installation	Guides
1. Privileged certificate enrollment	AD CS issues a temporary user certificate through CES; the CA restricts the enrollment agent, template and recipients.	Setuid launcher and dedicated service account	Setup · Flow
2. Privileged credential linking (Key Trust)	CRAFT temporarily adds a public key to the user's msDS-KeyCredentialLink; scoped AD delegation authorizes the write.	Setuid launcher and dedicated service account	Setup · Flow
3. Unprivileged Windows-exported certificate	The user enrolls and exports a certificate on Windows, transfers the PEM pair to Linux, and the KDC maps it to the account.	Ordinary executables running as the caller	Setup · Flow
4. Service tickets through constrained delegation	The broker uses S4U2Self/S4U2Proxy; AD restricts delegation to approved service SPNs.	Setuid launcher and dedicated service account	Setup · Flow

Set the ordered modes list in /etc/craft/config. For example, modes=home enrollment tries a caller-owned ~/.config/craft/user.pem and user.key pair, then enrollment if that attempt fails. modes=key_trust enrollment prefers directory linking and falls back to AD CS. Only listed modes may run, and the first successful acquisition supplies the cache. Invalid configuration, an interrupted worker, failed directory cleanup or cache-publication failure stops the request; if no mode succeeds, the existing cache remains unchanged.

Use modes=constrained_delegation alone to enforce service-ticket-only operation. Including a certificate mode explicitly permits a TGT through that mode. modes=home requires only ordinary executables and a valid PEM pair. See mode selection for ordering, prerequisites and failure behavior.

Users run craft directly, without sudo. All modes request <Linux username>@<configured realm>, validate the returned credentials and publish a caller-owned mode-0600 .krb5cc_craft in the home resolved by the Linux account database (NSS). Certificate and network processing run as the caller or the dedicated service account. Every mode needs administrator-controlled Kerberos configuration. Modes 1-3 need KDC certificate trust and current CRLs; modes 1 and 3 also validate the user certificate's CA chain and revocation.

Compile install and validate

Install the Linux dependencies, then compile as an ordinary user:

git clone https://github.com/nomorefood/craft.git
cd craft
cmake -S source -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build -j2
ctest --test-dir build --output-on-failure

Complete shared Linux installation, then the setup for each enabled mode. Modes 1, 2 and 4 also need the privileged installation. Configuration ships disabled; replace the examples, provision trust and credentials, and complete the deployment acceptance checks before production use.

Use the ticket cache

Run as the intended non-root Linux user:

cache=$(/usr/local/bin/craft) || exit "$?"
export KRB5CCNAME="$cache"
klist -ef -c "$KRB5CCNAME"

In modes 1-3, Kerberos-aware applications launched from that shell use the cache to obtain service tickets for SMB, LDAP and Kerberos-enabled web services. Access follows the user's existing permissions. CRAFT requests ten-hour TGT validity, seven-day renewal and AES256/AES128 encryption; the KDC controls the grant. Strict validation rejects shortened grants. Administrators can explicitly accept them with require_full_tgt_lifetime=no.

Mode 4 preloads only the configured service SPNs. It publishes no user/broker TGT or S4U2Self evidence, and cannot obtain additional service tickets. The KDC may shorten service_ticket_seconds; CRAFT accepts shorter valid AES tickets. See broker delegation setup and limits.

For long-running jobs, start maintenance once from the job script:

job_pid=$$
cache=$(/usr/local/bin/craft-maintain --watch-pid "$job_pid") || exit "$?"
export KRB5CCNAME="$cache"

TGT renewal uses the cache alone. Mode 4 refreshes the entire service batch through the broker before its earliest ticket expires. Fresh authentication invokes craft with the same mode selection. Maintenance stops with the watched job and leaves the cache. Replace supplied certificates before expiry; ticket maintenance does not renew them. See long-running jobs for scheduler requirements and status.

Administrator documentation

Guide	Purpose
Build installation and configuration	Dependencies, installation recipes, all configuration settings, Windows helpers and troubleshooting
Process overview (PDF)	Operating modes, identity, credential storage and ticket lifecycle
Configuration and validation (PDF)	Printable mode requirements, configuration and acceptance checks
Enrollment-agent restrictions	Mode 1 CA authorization and denial tests
Key Trust delegation	Mode 2 directory permissions, cleanup and denial tests
Constrained delegation	Mode 4 broker/SPN policy and service-only acceptance
Deployment validation	Offline checks, recorded coverage and live acceptance
Security and operations	Credential authority, trust boundaries and operational disable

All diagrams (PDF). Individual SVGs: mode selection, enrollment, credential linking, Windows export, credential timing, job maintenance, and constrained delegation.

Validation scope

Recorded AD lab runs cover Ubuntu 24.04.5 LTS and Rocky Linux 9.8 clients, Windows Server 2022 AD/AD CS/CES, and Windows Server 2019/2025 member servers. Additional Linux build and MIT KDC checks have narrower scope. See the validation record for results and limitations; other deployments need their own acceptance checks.

CRAFT is a reference implementation. It does not perform an MFA challenge or establish that one was completed. Protect the host, enrollment authority, directory delegation, supplied keys and ticket caches. Removing credentials, stopping maintenance or deleting a cache does not revoke already-issued tickets. No real credentials are bundled.

License

Source code, scripts, configuration examples and documentation are licensed under GNU GPL version 3 only (GPL-3.0-only).