code: func AcquireUserCredentials(domain, username, password string) (*sspi.Credentials, error) {
  	if len(username) == 0 {
  		return nil, errors.New("username parameter cannot be empty")
  	}
  	d, err := syscall.UTF16FromString(domain)
  	if err != nil {
  		return nil, err
  	}
  	u, err := syscall.UTF16FromString(username)
  	if err != nil {
  		return nil, err
  	}
  	p, err := syscall.UTF16FromString(password)
  	if err != nil {
  		return nil, err
  	}
  	ai := sspi.SEC_WINNT_AUTH_IDENTITY{
  		User:           &u[0],
  		UserLength:     uint32(len(u) - 1), // do not count terminating 0
  		Domain:         &d[0],
  		DomainLength:   uint32(len(d) - 1), // do not count terminating 0
  		Password:       &p[0],
  		PasswordLength: uint32(len(p) - 1), // do not count terminating 0
  		Flags:          sspi.SEC_WINNT_AUTH_IDENTITY_UNICODE,
  	}
  	return acquireCredentials("", sspi.SECPKG_CRED_OUTBOUND, &ai)
  }
docs: // TODO: see if I can share this common ntlm and negotiate code
  // AcquireUserCredentials acquires credentials of user described by
  // domain, username and password. These will be used by the client to
  // authenticate itself to the server. It will also be used by the
  // server to impersonate the user.