[22631] in Kerberos
Re: WindowsXP/Solaris : incorrect key version number
daemon@ATHENA.MIT.EDU (Jacques Lebastard)
Wed Oct 6 12:52:53 2004
Message-ID: <4164219A.5010806@evidian.com>
Date: Wed, 06 Oct 2004 18:47:22 +0200
From: Jacques Lebastard <Jacques.Lebastard@evidian.com>
MIME-Version: 1.0
To: kerberos@mit.edu
In-Reply-To: <41641447.4050808@anl.gov>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
Errors-To: kerberos-bounces@mit.edu
Douglas E. Engert wrote:
>
>
> Jacques Lebastard wrote:
>
>>
>> Hi there,
>>
>> a few days ago, I succeeded in running a SSPI/GSS-API client/server
>> program between an XP workstation and a Solaris server. The server's
>> keytab was generated using Windows 'ktpass' tool.
>
>
> Windows 2000 AD did not handle the kvno correctly and always used
> 1 or 0. 2003 does increment it each time it is changed. So you may
> have changed the number.
>
> Also when you use the ktpass, 2003 will update the password and kvno.
The last keytab generated by ktpass used kvno 10 for account's
principal. Even though the server does use that keytab,
gss_accept_sec_context fails.
Could it be that Windows SSPI keeps previous service tickets somewhere
in caches with the previous kvno ? Is the kvno visible when using
asn1dump on the GSS-API token ?
> If you have the MIT kerberos, you can verify the kvno in the AD
> by using kvno cvs/<hostname>@<realm> on the Solaris system.
Nope : "Solaris 9 kerberos" is in use.
> You can also get the kvno value by looking up the value of the
> "msDS-KeyVersionNumber" attribute of the account in Windows 2003 AD.
According to the AD schema, this attribute may be part of a
securityPrincipal object. However, I cannot find any such object using
LDAP browsers !
--
Mr. Jacques LEBASTARD mailto:jacques.lebastard@evidian.com
EVIDIAN S.A. www.evidian.com
Rue Jean Jaurès Tel: +33 1 30 80 77 86
F-78340 LES CLAYES SOUS BOIS Fax: +33 1 30 80 77 99
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
