[22986] in Kerberos
Re: IBM Java 1.4.2 Kerberos over TCP
daemon@ATHENA.MIT.EDU (Seema Malkani)
Fri Dec 3 02:57:05 2004
Date: Thu, 02 Dec 2004 23:58:01 -0800
From: Seema Malkani <Seema.Malkani@Sun.COM>
In-reply-to: <417413A3.2040809@anl.gov>
To: "Douglas E. Engert" <deengert@anl.gov>
Message-id: <41B01C89.2070506@sun.com>
MIME-version: 1.0
Content-type: text/plain; charset=ISO-8859-1; format=flowed
Content-transfer-encoding: 7BIT
cc: "'java-security@sun.com'" <java-security@Sun.COM>
cc: Pittman Daniel E Jr Civ 96 CG/SCTOA <daniel.pittman@eglin.af.mil>
cc: "'askibm@vnet.ibm.com'" <askibm@vnet.ibm.com>
cc: "'kerberos@mit.edu'" <kerberos@mit.edu>
Errors-To: kerberos-bounces@mit.edu
Following up on this email..
(this apparently got filtered with MIT alias)
Java GSS/Kerberos does support TCP
----------------------------
Sun's implementation of Java Kerberos now supports automatic fallback to
TCP. Therefore, if the Kerberos ticket request using UDP fails and the
KDC returns the error code ||KRB_ERR_RESPONSE_TOO_BIG, TCP is
automatically the default transport.
For Java GSS/Kerberos features available since J2SE1.4.2, please refer to:
http://java.sun.com/j2se/1.4.2/docs/guide/security/jgss/jgss-features.html
For latest Java GSS/Kerberos features in J2SE 1.5.0, please refer to:
http://java.sun.com/j2se/1.5.0/docs/guide/security/jgss/jgss-tiger.html
Seema
Douglas E. Engert wrote:
>
>
> Pittman Daniel E Jr Civ 96 CG/SCTOA wrote:
>
>> Hello, I am trying to connect to an AD 2003 server, and am
>> encountering the
>> following error
>> com.ibm.security.jgss.i18n.exception.KRBResponseTooBigError
>>
>> After doing some research, I have found this is related to a problem
>> which
>> occurs when a UDP packet is too large. UDP seems to be the only
>> connection
>> protocol supported in IBM's implementation of the Kerberos/JAAS
>> authentication schemes, could you please verify this information? It
>> would
>> be very helpful if there were a way to connect to an AD controller
>> via TCP.
>> I have already tried adding the line udp_preference_limit = 1 to my
>> krb5.conf file, and it seems to be ignored by the IBM implementation. I
>> would use the Sun implementation which does now support TCP, but that
>> solution is also equally filled with problems for me as it does not
>> support
>> the RC4/HMAC encryption scheme that my current situation is forcing
>> me to
>> use. Thanks in advance for any help you can provide.
>
>
> Another option: If the failure is in trying to get a service ticket
> and the service
> does not need the PAC (authorizaiton data added to a ticket that is
> used only
> by MS applications) then you could mark the service principal so that
> a PAC
> is not added to the ticket, and thus the ticket will be small and work
> with UDP.
>
> See http://support.microsoft.com/?kbid=832572
>
> But the Java should support TCP. The IETF IESG approved on Friday the
> replacement
> for RFC-1510. It is awaiting an RFC number.
> draft-ietf-krb-wg-kerberos-clarifications-07.txt states TCP is required.
>
>
>
>
>>
>>
>> Daniel E. Pittman, Jr
>> 96 CG/SCTOA
>> Phone: (850) 882-5498
>>
>> ________________________________________________
>> Kerberos mailing list Kerberos@mit.edu
>> https://mailman.mit.edu/mailman/listinfo/kerberos
>>
>>
>>
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
