Crate windows_lsa 

windows-lsa

Thin, safe wrapper around the Windows Local Security Authority (LSA) Kerberos authentication package primitives:

• LsaConnectUntrusted — get a handle to LSA that non-privileged code can use.
• LsaLookupAuthenticationPackage — resolve the "Kerberos" package id.
• LsaCallAuthenticationPackage with:
  • KerbRetrieveTicketMessage — pull the current TGT.
  • KerbQueryTicketCacheMessage — enumerate the LSA ticket cache.
  • KerbSubmitTicketMessage — inject a KRB-CRED into the cache.
  • KerbPurgeTicketCacheMessage — purge specific / all entries.

The 0.2 series implements the LSA transport and typed ticket-cache workflows. Structural parsing of returned Kerberos payloads remains intentionally minimal: raw bytes are exposed without ASN.1 decoding or KRB-CRED construction.

On non-Windows targets the crate compiles to a stub that returns Error::Unsupported for every call, so downstream crates can cfg-gate at their own convenience.

Structs

AuthPackageId

Identifier returned by LsaLookupAuthenticationPackage. Newtype so it cannot be confused with a raw u32.

KrbCred

A Kerberos credential blob as accepted by KerbSubmitTicketMessage and returned (in raw ticket form) by KerbRetrieveTicketMessage.

Lsa

LsaHandle

Luid

Windows Locally Unique Identifier — same wire layout as LUID / LARGE_INTEGER, kept target-neutral so it appears in the API on every OS.

TicketCacheInfo

One entry from KerbQueryTicketCacheMessage.

Enums

Error

Functions

purge_ticket_cache

Convenience wrapper around KerbPurgeTicketCacheMessage.

query_ticket_cache

Convenience wrapper around KerbQueryTicketCacheMessage.

retrieve_tgt

Convenience: connect, look up Kerberos, retrieve the TGT for the current logon session (or the caller-supplied LUID if luid is Some and the caller holds SeTcbPrivilege).

submit_ticket

Convenience wrapper around KerbSubmitTicketMessage.

Type Aliases

Result