shadow1ng/fscan · error

SSPI: %w

Error message

SSPI: %w

What it means

collectDomainInfo's connectToDomain failed to construct a Windows SSPI GSSAPI client; the gssapi.NewSSPIClient error is wrapped with the SSPI: prefix. SSPI is Windows-only, so this fails on non-Windows builds or when SSPI cannot initialize security credentials.

Source

Thrown at plugins/local/systeminfo_dc_windows.go:81

				domain := strings.TrimSpace(strings.TrimPrefix(line, "Domain="))
				if domain != "" && !strings.EqualFold(domain, "WORKGROUP") {
					return domain
				}
			}
		}
	}
	return ""
}

func (p *SystemInfoPlugin) connectToDomain(domain string) (*domainInfo, error) {
	dcHost, err := p.findDC(domain)
	if err != nil {
		return nil, err
	}

	client, err := gssapi.NewSSPIClient()
	if err != nil {
		return nil, fmt.Errorf("SSPI: %w", err)
	}
	defer func() { _ = client.Close() }()

	conn, err := ldap.DialURL(ldapURL(dcHost, 389))
	if err != nil {
		if ipv4, resolveErr := resolveIPv4(dcHost); resolveErr == nil {
			conn, err = ldap.DialURL(ldapURL(ipv4, 389))
		}
		if err != nil {
			return nil, fmt.Errorf("LDAP dial: %w", err)
		}
	}

	if err := conn.GSSAPIBind(client, fmt.Sprintf("ldap/%s", dcHost), ""); err != nil {
		_ = conn.Close()
		return nil, fmt.Errorf("GSSAPI bind: %w", err)
	}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Ensure the code runs only on Windows and is guarded by //go:build windows
2. Verify the Windows machine has SSPI security packages available (Security Support Provider Interface is built into supported Windows versions)
3. Run under a domain-joined account with rights to initiate SSPI/kerberos to the DC; check with klist
4. Inspect the wrapped error beneath "SSPI: " for the precise AcquireCredentialsHandle failure

Example fix

// guard the Windows-only path
//go:build windows

if runtime.GOOS != "windows" {
    return nil, fmt.Errorf("domain info requires windows")
}
client, err := gssapi.NewSSPIClient()

if runtime.GOOS != "windows" {
    return errors.New("SSPI domain collection requires Windows")
}
// optional: confirm domain membership
domain, _ := os.LookupEnv("USERDOMAIN")

func canUseSSPI() bool { return runtime.GOOS == "windows" }

client, err := gssapi.NewSSPIClient()
if err != nil {
    return nil, fmt.Errorf("SSPI unavailable (%v); falling back to unauthenticated LDAP", err)
}

When it happens

Trigger: gssapi.NewSSPIClient() returns an error: running on a non-Windows platform (build tag mismatch), missing Windows security support provider, or insufficient user credentials/token for SSPI.

Common situations: Compiling/running the Windows domain-info collector on Linux without the windows build constraint; stripped-down Windows installs lacking the Negotiate package; running in a service account context without domain credentials.

Related errors

• GSSAPI bind: %w
• LDAP dial: %w
• minidump_admin_required
• minidump_all_methods_failed
• oracle authentication failed

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/16fcb0ec693f5d62. Report an issue: GitHub.