Release 0.1.1: Kerberos SASL and reliability fixes

Bump version to 0.1.1 and add end-to-end Kerberos SASL GSSAPI support plus reliability and UX fixes. Key changes:

- Implement embedded Kerberos flow (Apache Kerby): build AP-REQ/AP-REP, request service tickets, SPN candidate discovery and AD-compatible KrbConfig. New classes: KerberosMutualAuthState, GssWrapToken (+ RFC1964 and CFX variants), and helpers in GssTokenCodec.
- Complete mutual AP-REP verification and RFC4752 security-layer negotiation (no-security-layer response). Prefer AP-REP subkey when available.
- DNS: prefer system resolver for A/AAAA lookups, prefer reverse PTR via system before MiniDNS, bound SRV timeouts and smarter SPN ranking to avoid public resolver REFUSED delays.
- SessionManager: fix keep-alive/reconnect bug by running silent reconnect on a detached job, preserve lastConnected snapshot, avoid cancelled reconnect leaving UI stuck.
- Logging: add AppLogger.debugEnabled toggle, wire settings toggle and persist it in SettingsDataStore/SettingsRepository; settings UI and strings updated.
- LdapClient: handle SASL bind continuation (SASL_BIND_IN_PROGRESS) including AP-REP verify, empty second bind, and final security-layer wrap exchange.
- UI: diagnostics/reports screens refactored to LazyColumn and various minor UX guards; connection/profile view improvements to avoid duplicate connects.
- Tests: add RFC1964 wrap round-trip unit tests and additional GSS token tests.
- Docs/Changelog updated and build versionCode/versionName bumped.

Also include numerous debug/log messages and error mappings to help troubleshooting.

Author: sannier3

CHANGELOG.md

@@ -6,6 +6,27 @@ The format is inspired by [Keep a Changelog](https://keepachangelog.com/).
 
 ## [Unreleased]
 
+## [0.1.1] — 2026-08-14
+
+Kerberos SASL bind against Active Directory is now usable end-to-end, with faster connect and a session keep-alive fix after screen lock.
+
+### Fixed
+
+- Complete GSSAPI SASL security-layer negotiation after mutual AP-REP (RFC 1964 / RC4-HMAC Wrap checksum, little-endian usage salt).
+- Prefer AP-REP subkey then ticket session key when unwrapping the server Wrap offer.
+- Silent LDAP reconnect after keep-alive failure no longer cancels itself mid-connect (dashboard stuck on “Connecting…” after unlock).
+- Skip public DNS SRV/A discovery when a Kerberos service principal is already configured (avoids multi-second REFUSED delays on phones using public resolvers).
+
+### Changed
+
+- A/AAAA lookups prefer the Android/system resolver (VPN / WireGuard DNS) instead of MiniDNS public resolvers.
+- Bound SRV discovery timeouts when SPN auto-discovery is still needed.
+- Guard against duplicate connect attempts after insecure-trust confirmation.
+
+### Added
+
+- Unit tests for RFC 1964 Wrap token round-trip (`GssWrapTokenRfc1964Test`).
+
 ## [0.1.0] — 2026-08-14
 
 First public application snapshot after the Android Studio scaffold. Early development — not a production AD release.

README.md

@@ -15,7 +15,7 @@ LDAPADvisor Android is a native Android application for:
 - Active Directory administrators
 - LDAP administrators
 
-Current builds (`0.1.0`) include working LDAP/LDAPS/StartTLS connectivity, AD discovery, directory browsing, selected AD administration actions, diagnostics, advisor findings, and report export. Treat results carefully: the project is still early, and some flows remain limited or unsupported (see [docs/implementation-status.md](docs/implementation-status.md) and [docs/limitations.md](docs/limitations.md)).
+Current builds (`0.1.1`) include working LDAP/LDAPS/StartTLS connectivity, embedded Kerberos SASL GSSAPI bind against AD, AD discovery, directory browsing, selected AD administration actions, diagnostics, advisor findings, and report export. Treat results carefully: the project is still early, and some flows remain limited or unsupported (see [docs/implementation-status.md](docs/implementation-status.md) and [docs/limitations.md](docs/limitations.md)).
 
 ## Planned Features
 
@@ -49,7 +49,7 @@ Object creation UI (create user/group/OU) is **limited** (message screens only)
 
 - Android 7.0 (API 24) or later
 - Native Kotlin application
-- `compileSdk` / `targetSdk` 37 (`versionName` `0.1.0`)
+- `compileSdk` / `targetSdk` 37 (`versionName` `0.1.1`)
 
 ## Technology
 
@@ -72,7 +72,7 @@ Currently used in this repository:
 
 ## Project Status
 
-**Early development** (`0.1.0`)
+**Early development** (`0.1.1`)
 
 Core LDAP/AD, diagnostics, advisor, and reporting paths are implemented in-tree. No stable production release is announced. See [docs/implementation-status.md](docs/implementation-status.md).
 

app/build.gradle.kts

@@ -15,8 +15,8 @@ android {
         applicationId = "com.jbsan.ldapadvisor"
         minSdk = 24
         targetSdk = 37
-        versionCode = 1
-        versionName = "0.1.0"
+        versionCode = 2
+        versionName = "0.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }

app/src/main/java/com/jbsan/ldapadvisor/app/AppContainer.kt

@@ -14,6 +14,7 @@ import com.jbsan.ldapadvisor.data.diagnostics.LdapDiagnosticService
 import com.jbsan.ldapadvisor.data.diagnostics.TcpDiagnosticService
 import com.jbsan.ldapadvisor.data.dns.AdDiscoveryService
 import com.jbsan.ldapadvisor.data.dns.DnsResolver
+import com.jbsan.ldapadvisor.data.kerberos.KerberosTicketService
 import com.jbsan.ldapadvisor.data.ldap.LdapClientFactory
 import com.jbsan.ldapadvisor.data.ldap.SessionManager
 import com.jbsan.ldapadvisor.data.report.ReportGenerator
@@ -47,14 +48,15 @@ class AppContainer(context: Context) {
         customCaDao = database.customCaDao(),
         logger = logger,
     )
+    val dnsResolver = DnsResolver()
     val sessionManager = SessionManager(
         clientFactory = ldapClientFactory,
         profileRepository = profileRepository,
         secretStore = secretStore,
         logger = logger,
+        kerberosTicketService = KerberosTicketService(logger, dnsResolver),
     )
 
-    val dnsResolver = DnsResolver()
     val adDiscoveryService = AdDiscoveryService(dnsResolver)
     val tlsDiagnosticService = TlsDiagnosticService(sslSocketFactoryFactory)
     val tcpDiagnosticService = TcpDiagnosticService()

app/src/main/java/com/jbsan/ldapadvisor/app/LdapAdvisorApp.kt

@@ -17,6 +17,11 @@ class LdapAdvisorApp : Application() {
         super.onCreate()
         container = AppContainer(this)
         container.networkMonitor.start()
+        appScope.launch {
+            container.settingsRepository.settings.collectLatest { settings ->
+                container.logger.debugEnabled = settings.debugLoggingEnabled
+            }
+        }
         appScope.launch {
             container.networkMonitor.networkAvailable.collectLatest { available ->
                 container.sessionManager.onNetworkAvailabilityChanged(available)

app/src/main/java/com/jbsan/ldapadvisor/core/logging/AppLogger.kt

@@ -17,6 +17,9 @@ data class LogEvent(
 )
 
 interface AppLogger {
+    /** When false, [LogLevel.DEBUG] events are dropped (not stored, not mirrored to logcat). */
+    var debugEnabled: Boolean
+
     fun log(
         level: LogLevel,
         component: String,

app/src/main/java/com/jbsan/ldapadvisor/core/logging/InMemoryAppLogger.kt

@@ -2,6 +2,7 @@ package com.jbsan.ldapadvisor.core.logging
 
 import android.util.Log
 import java.util.ArrayDeque
+import java.util.concurrent.atomic.AtomicBoolean
 import java.util.concurrent.atomic.AtomicInteger
 
 class InMemoryAppLogger(
@@ -13,6 +14,19 @@ class InMemoryAppLogger(
     private val lock = Any()
     private val events = ArrayDeque<LogEvent>(maxEvents)
     private val sequence = AtomicInteger(0)
+    private val debugFlag = AtomicBoolean(false)
+
+    override var debugEnabled: Boolean
+        get() = debugFlag.get()
+        set(value) {
+            val previous = debugFlag.getAndSet(value)
+            if (previous == value) return
+            if (value) {
+                emit(LogLevel.INFO, "AppLogger", "Debug logging enabled", null, null, null)
+            } else {
+                emit(LogLevel.INFO, "AppLogger", "Debug logging disabled", null, null, null)
+            }
+        }
 
     override fun log(
         level: LogLevel,
@@ -21,6 +35,18 @@ class InMemoryAppLogger(
         errorCode: String?,
         durationMs: Long?,
         throwable: Throwable?,
+    ) {
+        if (level == LogLevel.DEBUG && !debugEnabled) return
+        emit(level, component, message, errorCode, durationMs, throwable)
+    }
+
+    private fun emit(
+        level: LogLevel,
+        component: String,
+        message: String,
+        errorCode: String?,
+        durationMs: Long?,
+        throwable: Throwable?,
     ) {
         val sanitizedMessage = LogSanitizer.sanitize(message)
         val sanitizedDetails = throwable?.let {

app/src/main/java/com/jbsan/ldapadvisor/data/datastore/SettingsDataStore.kt

@@ -21,35 +21,12 @@ class SettingsDataStore(context: Context) {
     private val dataStore = context.applicationContext.settingsDataStore
 
     val settings: Flow<AppSettings> = dataStore.data.map { prefs ->
-        AppSettings(
-            themeMode = prefs[Keys.THEME]?.let { runCatching { ThemeMode.valueOf(it) }.getOrNull() }
-                ?: ThemeMode.SYSTEM,
-            readOnlyByDefault = prefs[Keys.READ_ONLY_BY_DEFAULT] ?: true,
-            defaultConnectTimeoutMs = prefs[Keys.CONNECT_TIMEOUT] ?: 5_000,
-            defaultReadTimeoutMs = prefs[Keys.READ_TIMEOUT] ?: 10_000,
-            diagnosticConcurrency = prefs[Keys.DIAG_CONCURRENCY] ?: 4,
-            diagnosticTcpTimeoutMs = prefs[Keys.DIAG_TCP_TIMEOUT] ?: 3_000,
-            reportSanitizationDefault = prefs[Keys.REPORT_SANITIZE] ?: true,
-            historyRetentionDays = prefs[Keys.HISTORY_RETENTION] ?: 30,
-            saveSearchHistory = prefs[Keys.SAVE_SEARCH_HISTORY] ?: true,
-        )
+        prefs.toAppSettings()
     }
 
     suspend fun update(transform: (AppSettings) -> AppSettings) {
         dataStore.edit { prefs ->
-            val current = AppSettings(
-                themeMode = prefs[Keys.THEME]?.let { runCatching { ThemeMode.valueOf(it) }.getOrNull() }
-                    ?: ThemeMode.SYSTEM,
-                readOnlyByDefault = prefs[Keys.READ_ONLY_BY_DEFAULT] ?: true,
-                defaultConnectTimeoutMs = prefs[Keys.CONNECT_TIMEOUT] ?: 5_000,
-                defaultReadTimeoutMs = prefs[Keys.READ_TIMEOUT] ?: 10_000,
-                diagnosticConcurrency = prefs[Keys.DIAG_CONCURRENCY] ?: 4,
-                diagnosticTcpTimeoutMs = prefs[Keys.DIAG_TCP_TIMEOUT] ?: 3_000,
-                reportSanitizationDefault = prefs[Keys.REPORT_SANITIZE] ?: true,
-                historyRetentionDays = prefs[Keys.HISTORY_RETENTION] ?: 30,
-                saveSearchHistory = prefs[Keys.SAVE_SEARCH_HISTORY] ?: true,
-            )
-            val next = transform(current)
+            val next = transform(prefs.toAppSettings())
             prefs[Keys.THEME] = next.themeMode.name
             prefs[Keys.READ_ONLY_BY_DEFAULT] = next.readOnlyByDefault
             prefs[Keys.CONNECT_TIMEOUT] = next.defaultConnectTimeoutMs
@@ -59,9 +36,24 @@ class SettingsDataStore(context: Context) {
             prefs[Keys.REPORT_SANITIZE] = next.reportSanitizationDefault
             prefs[Keys.HISTORY_RETENTION] = next.historyRetentionDays
             prefs[Keys.SAVE_SEARCH_HISTORY] = next.saveSearchHistory
+            prefs[Keys.DEBUG_LOGGING] = next.debugLoggingEnabled
         }
     }
 
+    private fun Preferences.toAppSettings(): AppSettings = AppSettings(
+        themeMode = this[Keys.THEME]?.let { runCatching { ThemeMode.valueOf(it) }.getOrNull() }
+            ?: ThemeMode.SYSTEM,
+        readOnlyByDefault = this[Keys.READ_ONLY_BY_DEFAULT] ?: true,
+        defaultConnectTimeoutMs = this[Keys.CONNECT_TIMEOUT] ?: 5_000,
+        defaultReadTimeoutMs = this[Keys.READ_TIMEOUT] ?: 10_000,
+        diagnosticConcurrency = this[Keys.DIAG_CONCURRENCY] ?: 4,
+        diagnosticTcpTimeoutMs = this[Keys.DIAG_TCP_TIMEOUT] ?: 3_000,
+        reportSanitizationDefault = this[Keys.REPORT_SANITIZE] ?: true,
+        historyRetentionDays = this[Keys.HISTORY_RETENTION] ?: 30,
+        saveSearchHistory = this[Keys.SAVE_SEARCH_HISTORY] ?: true,
+        debugLoggingEnabled = this[Keys.DEBUG_LOGGING] ?: false,
+    )
+
     private object Keys {
         val THEME = stringPreferencesKey("theme_mode")
         val READ_ONLY_BY_DEFAULT = booleanPreferencesKey("read_only_by_default")
@@ -72,5 +64,6 @@ class SettingsDataStore(context: Context) {
         val REPORT_SANITIZE = booleanPreferencesKey("report_sanitization_default")
         val HISTORY_RETENTION = intPreferencesKey("history_retention_days")
         val SAVE_SEARCH_HISTORY = booleanPreferencesKey("save_search_history")
+        val DEBUG_LOGGING = booleanPreferencesKey("debug_logging_enabled")
     }
 }

app/src/main/java/com/jbsan/ldapadvisor/data/dns/DnsResolver.kt

@@ -3,8 +3,6 @@ package com.jbsan.ldapadvisor.data.dns
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import org.minidns.hla.ResolverApi
-import org.minidns.record.A
-import org.minidns.record.AAAA
 import org.minidns.record.PTR
 import org.minidns.record.SRV
 import java.net.Inet4Address
@@ -26,35 +24,31 @@ data class DnsLookupResult(
 )
 
 /**
- * DNS resolver using MiniDNS with the device/system resolver path.
- * Does not hardcode Google/Cloudflare resolvers.
+ * DNS resolver preferring the Android/system resolver (VPN / private DNS / WireGuard)
+ * for A/AAAA. SRV still uses MiniDNS (system APIs do not expose SRV on all API levels).
  */
 class DnsResolver {
     private val api: ResolverApi = ResolverApi.INSTANCE
 
     suspend fun resolveA(name: String): Result<List<String>> = withContext(Dispatchers.IO) {
         try {
-            val result = api.resolve(name, A::class.java)
-            if (!result.wasSuccessful()) {
-                return@withContext Result.failure(
-                    IllegalStateException(result.responseCode?.name ?: "A lookup failed for $name"),
-                )
-            }
-            Result.success(result.answersOrEmptySet.map { it.inetAddress.hostAddress!! })
+            Result.success(
+                InetAddress.getAllByName(name)
+                    .filterIsInstance<Inet4Address>()
+                    .mapNotNull { it.hostAddress },
+            )
         } catch (e: Exception) {
             Result.failure(e)
         }
     }
 
     suspend fun resolveAAAA(name: String): Result<List<String>> = withContext(Dispatchers.IO) {
         try {
-            val result = api.resolve(name, AAAA::class.java)
-            if (!result.wasSuccessful()) {
-                return@withContext Result.failure(
-                    IllegalStateException(result.responseCode?.name ?: "AAAA lookup failed for $name"),
-                )
-            }
-            Result.success(result.answersOrEmptySet.map { it.inetAddress.hostAddress!! })
+            Result.success(
+                InetAddress.getAllByName(name)
+                    .filterIsInstance<Inet6Address>()
+                    .mapNotNull { it.hostAddress },
+            )
         } catch (e: Exception) {
             Result.failure(e)
         }
@@ -84,6 +78,11 @@ class DnsResolver {
 
     suspend fun resolvePtr(ip: String): Result<List<String>> = withContext(Dispatchers.IO) {
         try {
+            // Prefer system reverse lookup (honours VPN DNS).
+            val system = InetAddress.getByName(ip).canonicalHostName?.trim()?.trimEnd('.')
+            if (!system.isNullOrBlank() && !system.equals(ip, ignoreCase = true) && !looksLikeIp(system)) {
+                return@withContext Result.success(listOf(system))
+            }
             val arpa = toArpaName(ip)
             val result = api.resolve(arpa, PTR::class.java)
             if (!result.wasSuccessful()) {
@@ -149,4 +148,13 @@ class DnsResolver {
             else -> error("Unsupported address type")
         }
     }
+
+    private fun looksLikeIp(value: String): Boolean {
+        return try {
+            val a = InetAddress.getByName(value)
+            a.hostAddress.equals(value, ignoreCase = true) || value.contains(':')
+        } catch (_: Exception) {
+            false
+        }
+    }
 }