Extracting PAC from AD-generated ticket

I want to pull the PAC out of AD-generated Kerberos credentials.

1) Do I need to obtain a KerberosTicket, which I then examine as an ASN.1 encoded byte array, or is there an easier way?

2) If I want to get a KerberosTicket on the server side, after a client has juggled contexts with me, how do I do so?

3) What is the relationship of the token received by the server from the client to the memory region I need to examine to find the PAC?

4) Has anyone got an example of PAC decoding they could kindly share?

5) Has anyone got an example of an LDAP query using JNDI which inputs a stringified SID and outputs the group name in human-compatible form?

Thanks,

Alec

[713 byte] By [alec_gilchrista] at [2008-1-8]