Crate windows_lsa 

windows-lsa

Thin, safe wrapper around the Windows Local Security Authority (LSA) Kerberos authentication package primitives:

• [LsaConnectUntrusted] — get a handle to LSA that non-privileged code can use.
• [LsaLookupAuthenticationPackage] — resolve the "Kerberos" package id.
• [LsaCallAuthenticationPackage] with:
  • KerbRetrieveTicketMessage — pull the current TGT.
  • KerbQueryTicketCacheMessage — enumerate the LSA ticket cache.
  • KerbSubmitTicketMessage — inject a KRB-CRED into the cache.
  • KerbPurgeTicketCacheMessage — purge specific / all entries.

Status: pre-alpha, 0.1.0-dev. API surface is stable-ish, but structural parsing of the returned Kerberos payloads is minimal (raw byte extraction only — no ASN.1 decode, no KRB-CRED wrapping). Enough to prove the LSA plumbing works round-trip; not enough to be a drop-in Mimikatz replacement.

On non-Windows targets the crate compiles to a stub that returns Error::Unsupported for every call, so downstream crates can cfg-gate at their own convenience.

Structs

AuthPackageId

Identifier returned by LsaLookupAuthenticationPackage. Newtype so it cannot be confused with a raw u32.

KrbCred

A Kerberos credential blob as accepted by KerbSubmitTicketMessage and returned (in raw ticket form) by KerbRetrieveTicketMessage.

Lsa

LsaHandle

Luid

Windows Locally Unique Identifier — same wire layout as LUID / LARGE_INTEGER, kept target-neutral so it appears in the API on every OS.

TicketCacheInfo

One entry from KerbQueryTicketCacheMessage.

Enums

Error

Functions

purge_ticket_cache

Convenience wrapper around KerbPurgeTicketCacheMessage.

query_ticket_cache

Convenience wrapper around KerbQueryTicketCacheMessage.

retrieve_tgt

Convenience: connect, look up Kerberos, retrieve the TGT for the current logon session (or the caller-supplied LUID if luid is Some and the caller holds SeTcbPrivilege).

submit_ticket

Convenience wrapper around KerbSubmitTicketMessage.

Type Aliases

Result