{"record":{"id":"16fcb0ec693f5d62","repo":"shadow1ng/fscan","slug":"sspi-w","errorCode":null,"errorMessage":"SSPI: %w","messagePattern":"SSPI: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/local/systeminfo_dc_windows.go","lineNumber":81,"sourceCode":"\t\t\t\tdomain := strings.TrimSpace(strings.TrimPrefix(line, \"Domain=\"))\n\t\t\t\tif domain != \"\" && !strings.EqualFold(domain, \"WORKGROUP\") {\n\t\t\t\t\treturn domain\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn \"\"\n}\n\nfunc (p *SystemInfoPlugin) connectToDomain(domain string) (*domainInfo, error) {\n\tdcHost, err := p.findDC(domain)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tclient, err := gssapi.NewSSPIClient()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"SSPI: %w\", err)\n\t}\n\tdefer func() { _ = client.Close() }()\n\n\tconn, err := ldap.DialURL(ldapURL(dcHost, 389))\n\tif err != nil {\n\t\tif ipv4, resolveErr := resolveIPv4(dcHost); resolveErr == nil {\n\t\t\tconn, err = ldap.DialURL(ldapURL(ipv4, 389))\n\t\t}\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"LDAP dial: %w\", err)\n\t\t}\n\t}\n\n\tif err := conn.GSSAPIBind(client, fmt.Sprintf(\"ldap/%s\", dcHost), \"\"); err != nil {\n\t\t_ = conn.Close()\n\t\treturn nil, fmt.Errorf(\"GSSAPI bind: %w\", err)\n\t}\n","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/local/systeminfo_dc_windows.go#L63-L99","documentation":"collectDomainInfo's connectToDomain failed to construct a Windows SSPI GSSAPI client; the gssapi.NewSSPIClient error is wrapped with the SSPI: prefix. SSPI is Windows-only, so this fails on non-Windows builds or when SSPI cannot initialize security credentials.","triggerScenarios":"gssapi.NewSSPIClient() returns an error: running on a non-Windows platform (build tag mismatch), missing Windows security support provider, or insufficient user credentials/token for SSPI.","commonSituations":"Compiling/running the Windows domain-info collector on Linux without the windows build constraint; stripped-down Windows installs lacking the Negotiate package; running in a service account context without domain credentials.","solutions":["Ensure the code runs only on Windows and is guarded by //go:build windows","Verify the Windows machine has SSPI security packages available (Security Support Provider Interface is built into supported Windows versions)","Run under a domain-joined account with rights to initiate SSPI/kerberos to the DC; check with klist","Inspect the wrapped error beneath \"SSPI: \" for the precise AcquireCredentialsHandle failure"],"exampleFix":"// guard the Windows-only path\n//go:build windows\n\nif runtime.GOOS != \"windows\" {\n    return nil, fmt.Errorf(\"domain info requires windows\")\n}\nclient, err := gssapi.NewSSPIClient()","handlingStrategy":"fallback","validationCode":"if runtime.GOOS != \"windows\" {\n    return errors.New(\"SSPI domain collection requires Windows\")\n}\n// optional: confirm domain membership\ndomain, _ := os.LookupEnv(\"USERDOMAIN\")","typeGuard":"func canUseSSPI() bool { return runtime.GOOS == \"windows\" }","tryCatchPattern":"client, err := gssapi.NewSSPIClient()\nif err != nil {\n    return nil, fmt.Errorf(\"SSPI unavailable (%v); falling back to unauthenticated LDAP\", err)\n}","preventionTips":["Compile and run the SSPI path only on Windows (build tags)","Run under a domain-joined account with valid credentials (verify with klist)","Provide a fallback to unauthenticated/anonymous LDAP where acceptable","Log the wrapped SSPI error cause for support"],"tags":["windows","sspi","ldap","authentication","gssapi"],"backgroundTag":"authentication-required","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}