nsspi VS Kerberos.NET

I had this problem in spades when I was learning how to invoke the Windows SSPI api. It ended up being so complicated I wrote an entire project to do it, because I also had to manually handle the CER concerns of pinvokeing.

Since I'm in an enterprise with AD, I was planning on just directly using Windows Integrated authentication (I wrote a library to do just this: NSSPI). The clients will send messsages (over the gateway) to the Auth Service and ask to perform auth directly. After Auth is complete, the Auth service will hand back a signed JWT token and all requests the client makes to any other service after that point will have the bearer token.

The mapping of Windows Services to SPNs is a bit lopsided. There's only a handful of SPNs on any given computer object, but that's okay because there's a special SPN called host/computername that is a catch-all. There's a mapping of 50 or so service types mapped to host so when you ask for say fax/computername, AD will treat that as a search 'find me fax/computername OR find me host/computername'. There's an official list on docs somewhere (can't find it), but here's a mapping I created from that official list. All of this lopsidedness works because the local services are running as local system or network service, and therefore use the computer account.