[22987] in Kerberos
Re: IBM Java 1.4.2 Kerberos over TCP
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Fri Dec 3 07:49:22 2004
Message-ID: <41B06011.3030508@anl.gov>
Date: Fri, 03 Dec 2004 06:46:09 -0600
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: Seema Malkani <Seema.Malkani@Sun.COM>
In-Reply-To: <41B01C89.2070506@sun.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: "'java-security@sun.com'" <java-security@Sun.COM>
cc: Pittman Daniel E Jr Civ 96 CG/SCTOA <daniel.pittman@eglin.af.mil>
cc: "'askibm@vnet.ibm.com'" <askibm@vnet.ibm.com>
cc: "'kerberos@mit.edu'" <kerberos@mit.edu>
Errors-To: kerberos-bounces@mit.edu
Seema Malkani wrote:
> Following up on this email..
> (this apparently got filtered with MIT alias)
>
Can you answer the other question in the user's orginal question?
He needs both TCP and RC4/HMAC. When will the Sun Java support
RC4/HMAC for better compatability with Windows?
> Java GSS/Kerberos does support TCP
> ----------------------------
> Sun's implementation of Java Kerberos now supports automatic fallback to
> TCP. Therefore, if the Kerberos ticket request using UDP fails and the
> KDC returns the error code ||KRB_ERR_RESPONSE_TOO_BIG, TCP is
> automatically the default transport.
>
> For Java GSS/Kerberos features available since J2SE1.4.2, please refer to:
> http://java.sun.com/j2se/1.4.2/docs/guide/security/jgss/jgss-features.html
>
> For latest Java GSS/Kerberos features in J2SE 1.5.0, please refer to:
> http://java.sun.com/j2se/1.5.0/docs/guide/security/jgss/jgss-tiger.html
>
> Seema
>
> Douglas E. Engert wrote:
>
>>
>>
>> Pittman Daniel E Jr Civ 96 CG/SCTOA wrote:
>>
>>> Hello, I am trying to connect to an AD 2003 server, and am
>>> encountering the
>>> following error
>>> com.ibm.security.jgss.i18n.exception.KRBResponseTooBigError
>>>
>>> After doing some research, I have found this is related to a problem
>>> which
>>> occurs when a UDP packet is too large. UDP seems to be the only
>>> connection
>>> protocol supported in IBM's implementation of the Kerberos/JAAS
>>> authentication schemes, could you please verify this information? It
>>> would
>>> be very helpful if there were a way to connect to an AD controller
>>> via TCP.
>>> I have already tried adding the line udp_preference_limit = 1 to my
>>> krb5.conf file, and it seems to be ignored by the IBM implementation. I
>>> would use the Sun implementation which does now support TCP, but that
>>> solution is also equally filled with problems for me as it does not
>>> support
>>> the RC4/HMAC encryption scheme that my current situation is forcing
>>> me to
>>> use. Thanks in advance for any help you can provide.
>>
>>
>>
>> Another option: If the failure is in trying to get a service ticket
>> and the service
>> does not need the PAC (authorizaiton data added to a ticket that is
>> used only
>> by MS applications) then you could mark the service principal so that
>> a PAC
>> is not added to the ticket, and thus the ticket will be small and work
>> with UDP.
>>
>> See http://support.microsoft.com/?kbid=832572
>>
>> But the Java should support TCP. The IETF IESG approved on Friday the
>> replacement
>> for RFC-1510. It is awaiting an RFC number.
>> draft-ietf-krb-wg-kerberos-clarifications-07.txt states TCP is required.
>>
>>
>>
>>
>>>
>>>
>>> Daniel E. Pittman, Jr
>>> 96 CG/SCTOA
>>> Phone: (850) 882-5498
>>>
>>> ________________________________________________
>>> Kerberos mailing list Kerberos@mit.edu
>>> https://mailman.mit.edu/mailman/listinfo/kerberos
>>>
>>>
>>>
>>
>
>
>
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
