Update

vendor/github.com/alexbrainman/sspi/internal/common/common.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build windows
 // +build windows
 
 package common
@@ -41,19 +42,34 @@ func BuildAuthIdentity(domain, username, password string) (*sspi.SEC_WINNT_AUTH_
 }
 
 func UpdateContext(c *sspi.Context, dst, src []byte, targetName *uint16) (authCompleted bool, n int, err error) {
-	var inBuf, outBuf [1]sspi.SecBuffer
+	return UpdateContextWithChannelBindings(c, dst, src, nil, targetName)
+}
+
+// UpdateContextWithChannelBindings performs SSPI context update with optional channel binding tokens.
+func UpdateContextWithChannelBindings(c *sspi.Context, dst, src, channelBindings []byte, targetName *uint16) (authCompleted bool, n int, err error) {
+	var inBuf [2]sspi.SecBuffer
+
 	inBuf[0].Set(sspi.SECBUFFER_TOKEN, src)
 	inBufs := &sspi.SecBufferDesc{
 		Version:      sspi.SECBUFFER_VERSION,
 		BuffersCount: 1,
 		Buffers:      &inBuf[0],
 	}
+
+	if len(channelBindings) > 0 {
+		// With channel bindings: TOKEN buffer + CHANNEL_BINDINGS buffer
+		inBuf[1].Set(sspi.SECBUFFER_CHANNEL_BINDINGS, channelBindings)
+		inBufs.BuffersCount = 2
+	}
+
+	var outBuf [1]sspi.SecBuffer
 	outBuf[0].Set(sspi.SECBUFFER_TOKEN, dst)
 	outBufs := &sspi.SecBufferDesc{
 		Version:      sspi.SECBUFFER_VERSION,
 		BuffersCount: 1,
 		Buffers:      &outBuf[0],
 	}
+
 	ret := c.Update(targetName, outBufs, inBufs)
 	switch ret {
 	case sspi.SEC_E_OK:

vendor/github.com/alexbrainman/sspi/syscall.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build windows
 // +build windows
 
 package sspi
@@ -96,19 +97,20 @@ type CredHandle struct {
 const (
 	SECURITY_NATIVE_DREP = 16
 
-	SECBUFFER_DATA           = 1
-	SECBUFFER_TOKEN          = 2
-	SECBUFFER_PKG_PARAMS     = 3
-	SECBUFFER_MISSING        = 4
-	SECBUFFER_EXTRA          = 5
-	SECBUFFER_STREAM_TRAILER = 6
-	SECBUFFER_STREAM_HEADER  = 7
-	SECBUFFER_PADDING        = 9
-	SECBUFFER_STREAM         = 10
-	SECBUFFER_READONLY       = 0x80000000
-	SECBUFFER_ATTRMASK       = 0xf0000000
-	SECBUFFER_VERSION        = 0
-	SECBUFFER_EMPTY          = 0
+	SECBUFFER_DATA             = 1
+	SECBUFFER_TOKEN            = 2
+	SECBUFFER_PKG_PARAMS       = 3
+	SECBUFFER_MISSING          = 4
+	SECBUFFER_EXTRA            = 5
+	SECBUFFER_STREAM_TRAILER   = 6
+	SECBUFFER_STREAM_HEADER    = 7
+	SECBUFFER_PADDING          = 9
+	SECBUFFER_STREAM           = 10
+	SECBUFFER_CHANNEL_BINDINGS = 14
+	SECBUFFER_READONLY         = 0x80000000
+	SECBUFFER_ATTRMASK         = 0xf0000000
+	SECBUFFER_VERSION          = 0
+	SECBUFFER_EMPTY            = 0
 
 	ISC_REQ_DELEGATE               = 1
 	ISC_REQ_MUTUAL_AUTH            = 2