[23420] in Kerberos
Re: AD Domain Authentication to MIT Kerb V
daemon@ATHENA.MIT.EDU (Matt Joyce)
Fri Feb 18 17:25:42 2005
Message-ID: <42166B34.3030508@vtsystems.com>
Date: Fri, 18 Feb 2005 17:24:52 -0500
From: Matt Joyce <syslists@vtsystems.com>
MIME-Version: 1.0
To: "Douglas E. Engert" <deengert@anl.gov>
In-Reply-To: <421665EB.8020005@anl.gov>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
Reply-To: syslists@vtsystems.com
Errors-To: kerberos-bounces@mit.edu
Douglas E. Engert wrote:
>
>
> Matt Joyce wrote:
>
>>>
>>>
>>> So when you login, do you type user@realm or just user?
>>>
>> just user. The @ seemingly specifies a domain to login to.
>
>
> No its the realm of the user. This machine knows what domain it is in.
> So the first step it to authenticate to the user's realm, then
> the libs will get cross realm tickets and finals a service ticket
> for the machine from the machine's realm.
>
So it is still within the DOMAIN.COM domain not a seperate
REALM.DOMAIN.COM domain. Okay That clears something up.
If this is the case do I need to add host principles to the MIT Kerb V
kdc for the machines in the domain wishing to auth to the
REALM.FXSERVER.COM principles? Do I need to join the REALM on the
client boxes? Should I be seeing the REALM option in the domain list? =(
Is there anything special I need to do to those client machines?
currently I am unable to login to user@REALM.DOMAIN.COM on anything but
the AD box. Any suggestions as to why that might be?
>> I cannot login to a Domain with a complete realm prinicpal without
>> inadvertental telling windows to login to som alternate domain...
>
>
> *BUT thats the point* the user is in one realm the machine in another.
> They can trust each other because you setup the cross realm, and with AD,
> the AD of the machine spotted that your user has an AD account, and so it
> added PAC information so the machine would accept the user as domain
> user.
>
> > possibly a trusted kerb5 realm domain created by AD?
>
> Not sure what you mean. AD does not create realms. Although domains in
> a forest are using Kerberos cross realm.
>
This cleared up all sorts of misunderstandings I had. =) Well I am
seeing lots of DOMAIN.COM tickets but no REALM.DOMAIN.COM tickets. But
that's probably because I've been thinking i need to login to the AD
domain not the REALM. =/
>>>
>> When i login to the Domain as a regular user MIT leash shows me a wad
>> of @DOMAIN.COM tickets. Can I assume these tickets will be honored
>> by services in the MIT Kerb V realm REALM.DOMAIN.COM?
>
>
> Yes and no. The tickets are for selected services in what ever realm
> the service is in. Since the user is in DOMAIN.COM one of the tickets
> is krbtgt/DOMAIN.COM@DOMAIN.COM this is the ticket granting ticket used
> to get more tickets from DOMAIN.COM for services in that realm.
>
> There may also be a krbtgt/REALM.DOMAIN.COM@DOMAIN.COM This is the cross
> realm ticket issued by DOMAIN.COM used to get tickets from
> REALM.DOMAIN.COM
> But you would only see this if the user attempted to use a service in
> REALM.DOMAIN.COM.
>
> When you get this working you using the user in REALM.DOMAIN.COM
> you should see these tickets:
>
> krbtgt/REALM.DOMAIN.COM@REALM.DOMAIN.COM (initial ticket)
Don't have that.
> krbtgt/DOMAIN.COM@REALM.DOMAIN.COM (cross realm ticket)
or that
> host/theworkstaiton@DOMAIN.COM (service ticket for host)
>
>>
>> This line of discussion is really really helpful thanks a ton.
>
Still is =P
-Matt Joyce
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
