Krberror hides original error

[lorenz]

When requesting a TGT with Kerberos the client.ASExchange() function returns a krberror.Krberror which provides no way to access the original ErrorCode. This makes it very brittle to depend on Kerberos error codes (for example to detect KDC_ERR_KEY_EXPIRED).

[jcmturner]

I have been working on improving the krberror package so that is uses error wrapping. Once this is implemented then you should be able to...

var target messages.KRBError
errors.As(err, &target)
ecode := target.ErrorCode

Would this be suitable?

[lorenz]

This is what my code already looks like, so this would be perfect.