[22657] in Kerberos
Re: KRB5 error code 52
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Thu Oct 7 17:32:04 2004
Message-ID: <4165B500.407@anl.gov>
Date: Thu, 07 Oct 2004 16:28:32 -0500
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: Wyllys Ingersoll <wyllys.ingersoll@sun.com>
In-Reply-To: <41658B77.9030904@sun.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
cc: Tyson Oswald <oswaldt@ameritech.net>
Errors-To: kerberos-bounces@mit.edu
Wyllys Ingersoll wrote:
>
> MaxTokenSize is not a SEAM parameter. If the size of the token is too
> large to fit in a single UDP datagram when PAC data is included, the KDC
> switches to TCP.
> I think Windows 2003 Server has a flag that can be set on the user
> principals
> to force it to stop putting PAC data in the tickets for that user, which
> will
> fix the problem.
>
The flag is set on the server principal in AD to tell AD not to add a PAC to
any service tickets for the server.
See: http://support.microsoft.com/?kbid=832572
But your problem may be with the TGT.
> For previous releases (Windows 2000 server), I *think* if you disable
> the use of pre-authentication for those users then that will also cause the
> AD KDC to stop issuing PAC data with those tickets.
There is a way to tell the AD to not add a pack when getting a TGT,
(a preauth with PA_PAC_REQUEST) but this would require the SEAM kinit
to send this.
The real fix to to have SEAM support TCP to the KDC.
Temp fix, is to not have a user in too many groups.
>
> -Wyllys
>
>
>
> Tyson Oswald wrote:
>
>> So what is the MaxTokenSize in SEAM, I just got a formula from MS on
>> what they use for 2003. Also we don't have this issue in SEAM for
>> Solaris 8 so what's different?
>>
>> thanks,
>> Tyson Oswald
>>
>> h.dadgari@comcast.net wrote in message
>> news:<100520041836.10730.4162E9A70001ACE5000029EA2200750784079D0E090B0E0BD208@comcast.net>...
>>
>>
>>
>>> SEAM 1.01 doesn't support TCP, later version on Solaris 10 support TCP
>>>
>>> Hooshang
>>>
>>>
>>>
>>>
>>>> Kerberos experts,
>>>>
>>>> I am using SEAM 1.01 on Solaris 9 and am authenticating to AD. When
>>>> others try they fail the login with the "KRB5 error code 52" error.
>>>> I read that this has something to do with UDP packet size and to try
>>>> TCP. Is there a way in SEAM to have it use TCP rather then UDP, or
>>>> to try UDP then TCP is that fails? I was hoping there was a
>>>> configuration parameter in krb5.conf.
>>>>
>>>> thanks,
>>>> Tyson Oswald
>>>> _______________________________________________
>>>>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
