[22237] in Kerberos
RE: Using Windows AD generated Kerberos tickets without a PAC
daemon@ATHENA.MIT.EDU (Luke Howard)
Wed Aug 18 21:42:59 2004
From: Luke Howard <lukeh@padl.com>
Message-Id: <200408190140.LAA45563@au.padl.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
To: Bob.Smart@csiro.au
Date: Thu, 19 Aug 2004 11:40:10 +1000
cc: deengert@anl.gov
cc: kerberos@mit.edu
Reply-To: lukeh@padl.com
Errors-To: kerberos-bounces@mit.edu
>I presume that this only applies when users kinit from a unix
>environment. I.e. if you install this patch and configure users with
>this option then it will have no affect when they do a domain login and
>access windows resources. It will only change the behaviour when they do
>a kinit in a unix environment.
You don't configure ordinary users with this option; rather, you configure
service accounts (e.g. machines).
>I hope. Otherwise its not much use (in which case I'd really like to see
>the kinit option added, to not request a PAC. Indeed I think that is a
>good idea anyway because I'm quite sure our Domain Controller people
>will be hard to convince to apply this patch, and I'm sure I won't be
>the only one in that regard.)
Certainly, you can modify kinit to send pre-authentication data to the
domain controller asking it not to include a PAC. But this doesn't help
you if you have logged onto a Windows client and wish to access a UNIX
service that cannot deal with the increased ticket size.
cheers,
-- Luke
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
