[22749] in Kerberos
Re: Cross realm auth with MS Server 2003 and MIT kerb
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Mon Oct 25 16:29:18 2004
Message-ID: <417D6103.8000008@anl.gov>
Date: Mon, 25 Oct 2004 15:24:35 -0500
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: BarBaar <beurdy@priest.com>
In-Reply-To: <b87356fd.0410250521.742f3c67@posting.google.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
BarBaar wrote:
> Hello,
>
> Today I started to sniff the network, while trying to setup aan
> cross-realm kerberos-session... (realm named: test.nl and
> tester.test.nl)
>
You have lost me here. What is the W2k3 AD domain name and what is the
MIT KDC realm name? Yesterday there where TEST.NL (AD) and TEST2.NL (MIT)
and the user is testor@TEST2.NL.
> And the sniffer (ethereal) did not tell me very much.. But he did tell
> me the WinXp client is requesting a TGS from the w2k3 AD KDC (which is
> good!). And the AD KDC send a error back:
> krb5kdc_err_s_principal_unknown.. (which is not good)
>
> So (correct me if I am wrong) the AD KDC does not see that this host
> is in a different realm, and therefore does not respond with the
> correct ticket (which should be a krbtgt/TEST.NL@TESTER.TEST.NL?)
In strick Kerberos terms. The first request should be for a TGT for the
user from the user's realm. It does not mater what is the realm of the
host at this point. But if you don't fully qualify the user principal,
it will default the user's realm from the realm of the host.
But yesterday you where trying to have the user in the MIT realm,
so it is not suprising that the W2K returns principal_unknown.
So try login as testor@TEST2.NL giving the full principal name.
It should then try and contact the MIT KDC at TEST2.NL and get
testor@TEST2.NL krbtgt/TEST2.NL@TEST2.NL ticket. It will then determine
that the host is from a different realm, and will then try and get from
TEST2.NL a krbtgt/TEST.NL@TEST2.NL
See if you can get this far.
It will then use this TGT against AD to get a host/xpclient.name@TEST.NL
But this may get a ticket but not let you login as there is no
PAC.
>
> Any ideas on this?
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
