3.1.5.2 RemoteCallKerbBuildAsReqAuthenticator
The RemoteCallKerbBuildAsReqAuthenticator call uses the Kerberos BuildAsReqAuthenticator message (section 2.2.2.1.2) to create an authenticator for inclusion in a KRB_AS_REQ message to the KDC.
To perform this message exchange, the CredSSP server MUST send a KerbCredIsoRemoteInput object to the CredSSP client. The CallId field MUST be set to RemoteCallKerbBuildAsReqAuthenticator, and the BuildAsReqAuthenticator member of the union MUST be populated.
To reply to the preceding input message, the CredSSP client MUST respond with a KerbCredIsoRemoteOutput object. The CallId field MUST be set to RemoteCallKerbBuildAsReqAuthenticator, and the BuildAsReqAuthenticator member of the union MUST be populated.