[22240] in Kerberos
Re: Using Windows AD generated Kerberos tickets without a PAC
daemon@ATHENA.MIT.EDU (Luke Howard)
Thu Aug 19 10:27:03 2004
From: Luke Howard <lukeh@padl.com>
Message-Id: <200408191424.AAA08153@au.padl.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
To: deengert@anl.gov
Date: Fri, 20 Aug 2004 00:24:57 +1000
cc: kerberos@mit.edu
cc: bob.smart@csiro.au
Reply-To: lukeh@padl.com
Errors-To: kerberos-bounces@mit.edu
>You would not want to set this to a windows user account, as it might mean
>that the user could not windows without a PAC.
Actually, it probably won't make any difference if you set it on a user
account (although I haven't tried -- be interested to know).
If you set it on a machine trust account for a Windows workstation then,
yes, I would expect that you would not be able to logon.
>There is a way to request a TGT without a PAC today. If the AS-REQ has a
>PA-DATA with the PA-PAC-REQUEST the AD will not add a PAC. The Windows
>runas /netonly command sends this. I have a patch some where to add this
>to the MIT kinit. If you are interested, drop me a note and I will find them.
I think the Heimdal kinit already supports this.
-- Luke
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
