feat: extract Windows identity from LDAP + Kerberos traffic (#809)

[NotYuSheng]

Closes #809. Motivated by #808 — a CTF-demo walkthrough of a real malware-traffic-analysis.net incident found TracePcap correctly identifies malware C2 (Suricata) and victim IP/MAC/hostname unprompted, but had zero LDAP/Kerberos parsing and missed the victim's real identity (ccollier / "Clark Collier"), which the exercise's own official answer key found via a manual LDAP filter.

Two corroborating signals, verified directly against the real capture

• Kerberos AS-REQ (kerberos.msg_type==10, kerberos.CNameString) — sent by the client itself, so this is MEASURED-grade: unambiguous proof of who is logged in at that IP. AS-REP/TGS-REP are deliberately excluded: their source IP is the KDC, not the client, so including them would mislabel the domain controller's own IP with every account it has ever issued a ticket for.
• LDAP searchRequest DN (ldap.baseObject) — REPORTED-grade and weaker (ambiguous: could be a self-lookup, or a query about someone else). Filtering on which attributes were requested (givenName, sn, displayName, ...) was tried and abandoned: a certificate-template DN in the real capture legitimately requests displayName/cn too, producing a false positive. The robust discriminator is the DN's own shape (CN=<name>,CN=Users,DC=...) — AD person objects live under CN=Users; infrastructure objects do not.

Machine-account principals (DESKTOP-SKBR25F$) are excluded. No cleartext LDAP bind credential (ldap.simple) is ever requested or parsed — stated as a deliberate design constraint in the resolver's own class doc.

Architecture — two existing patterns, not a new one

• Extraction: the conflict-preserving hostname-claims pattern (HostnameResolverService/HostnameClaimWriter) — a username is testimony, not a measurement to pick a winner for at write time.
• Adjudication: the generic Adjudicator/HumanOverrideEntity framework (not the older static-priority HostnameAdjudicator) — a new "windows-identity" question gets human override, staleness, and audit trail for free, with zero new table or REST endpoint for override support. Deliberately simpler than HostIdentityService: source-priority (Kerberos > LDAP-DN), not weighted voting, since there's no equivalent of device-type classification signals to combine.

A new WindowsIdentityClaimLookup SPI port (analysis.spi) is required by the frozen ArchUnit layer rule (modules_use_analysis_spi_not_its_internals) — the insights-module adjudicator can't import analysis' repository/entity directly. LayerDependencyTest passes with the frozen store unchanged.

Frontend needed zero new components: AdjudicationPanel is already question-agnostic by design — this is one new instance in HostIdentitySection.tsx.

Verified end-to-end against the real exercise capture

Rebuilt the backend, uploaded the actual "You dirty rat!" exercise pcap, confirmed via GET /files/{fileId}/windows-identities:

[
  {
    "ip": "172.16.1.66",
    "primaryLabel": "ccollier",
    "basis": "MACHINE",
    "confidence": 90,
    "contested": false,
    "candidates": [
      { "label": "ccollier", "score": 90, "source": "kerberos_as_req" },
      { "label": "Clark Collier", "score": 55, "source": "ldap_dn" }
    ]
  }
]

Also confirmed: exactly one row total (no false positive on the domain controller 172.16.1.4), and no $-suffixed machine-account principal ever surfaces as a primary label anywhere.

Test plan

• mvn test -Dtest=WindowsIdentityResolverServiceTest,WindowsIdentityServiceTest — 11/11 pass (DN-regex discriminator including the real certificate-template false-positive case, machine-account exclusion, Kerberos-over-LDAP priority, contested-on-multiple-distinct-usernames, human-override-preserves-machine-candidates, no-claims-no-row)
• mvn test -Dtest=LayerDependencyTest — passes, frozen ArchUnit store unchanged
• mvn test (full backend suite) — 494/494 effective pass (1 skipped, unrelated @Tag("system") test)
• npm run typecheck / npm run test / npm run lint (frontend) — typecheck clean, 642/642 tests pass, new code lint-clean
• Migrations V42/V43 applied cleanly on a real Postgres via Flyway (Successfully applied 2 migrations ... now at version v43)
• Adjudicator auto-registered with zero manual wiring, confirmed via startup log: Adjudicate: 2 adjudicator(s) (2 DETERMINISTIC) — questions: host-identity, windows-identity
• End-to-end: real exercise pcap uploaded to a rebuilt backend, ccollier surfaces correctly at GET /files/{fileId}/windows-identities with both signals cited
• OpenAPI contract regenerated (openapi/baseline.json, frontend/src/services/api/generated/schema.d.ts) against the live rebuilt backend

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 53b95b78-817c-4cf9-9015-26999d82dd2a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}