[29451] in Kerberos
Re: using UPN to auth
daemon@ATHENA.MIT.EDU (Markus Moeller)
Tue Mar 11 20:34:00 2008
To: kerberos@mit.edu
From: "Markus Moeller" <huaraz@moeller.plus.com>
Date: Wed, 12 Mar 2008 00:32:41 -0000
Message-ID: <fr78bf$qvt$1@ger.gmane.org>
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_12DE_01C883D8.95B30090"
X-Complaints-To: usenet@ger.gmane.org
In-Reply-To: <8ee061010803111146g3d5b36b2rd5e22be1d3961073@mail.gmail.com>
Errors-To: kerberos-bounces@mit.edu
This is a multi-part message in MIME format.
------=_NextPart_000_12DE_01C883D8.95B30090
Content-Type: text/plain; format=flowed; charset="iso-8859-1";
reply-type=original
Content-Transfer-Encoding: 7bit
You need a modified kinit which sets the principal type to 10 (enterprise
name type). Windows will then use the UPN instead of the samaccountname to
authenticate. (See attached sample mkinit.c)
Markus.
BTW If your client support client canonicalisation you can authenticate as
jdoe@domain.com but get a ticket for samaccountname.
"Terry" <td3201@gmail.com> wrote in message
news:8ee061010803111146g3d5b36b2rd5e22be1d3961073@mail.gmail.com...
> Hello,
>
> I am very new to this. I have a FQDN in AD set to domain.foo. The
> UPN of a user is jdoe@domain.com. (note the difference between foo
> and com).
>
> How can I authenticate with jdoe@domain.com? I am able to auth
> correctly with the sAMAccountName.
>
> Thanks!
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
------=_NextPart_000_12DE_01C883D8.95B30090
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
------=_NextPart_000_12DE_01C883D8.95B30090--
