[23526] in Kerberos
RE: Cross-realm Authentication with Windows Server 2003
daemon@ATHENA.MIT.EDU (Walter Weiss)
Mon Mar 14 19:06:12 2005
Content-class: urn:content-classes:message
MIME-Version: 1.0
Date: Mon, 14 Mar 2005 19:05:34 -0500
Message-ID: <FFDFACCFFB67C24DBDB8C507EFEC159E018D0B9F@AGSCIEX3.AGSCI.WIN.PSU.EDU>
From: "Walter Weiss" <wuw1@psu.edu>
To: <kerberos@mit.edu>
Content-Type: multipart/mixed; boundary="===============068614387827873546=="
Errors-To: kerberos-bounces@mit.edu
This is a multi-part message in MIME format.
--===============068614387827873546==
Content-class: urn:content-classes:message
Content-Type: multipart/signed;
protocol="application/x-pkcs7-signature";
micalg=SHA1;
boundary="----=_NextPart_000_0000_01C528C8.D520E440"
This is a multi-part message in MIME format.
------=_NextPart_000_0000_01C528C8.D520E440
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
The easiest way to do it on the Windows side is through the active directory
domains and trusts. There is an excellent white paper put out by Microsoft
that details the process for Windows 2000 but still applies to 2003. We just
set this up for a one way trust, works flawlessly.
http://www.microsoft.com/windows2000/techinfo/planning/security/kerbsteps.asp
Walter Weiss
-----Original Message-----
From: kerberos-bounces@mit.edu [mailto:kerberos-bounces@mit.edu] On Behalf Of
Jeremy J. Casper
Sent: Monday, March 14, 2005 5:27 PM
To: kerberos@mit.edu
Subject: Cross-realm Authentication with Windows Server 2003
We are trying to setup a kerberos pass-thru authenticated logon in a
windows 2003 server forest. We have tried the following steps to get
the pass-thru to work, but are currently getting an error message when
we try to login. We have done the following steps on both the AD
controller and the Kerberos server.
Active Directory Domain is AD.SCHOOL.EDU
Kerberos realm is SCHOOL.EDU
Kerberos server
Active Directory Server
1. ran the following command "ksetup /addkdc SCHOOL.EDU kerberos.SCHOOL.EDU"
2. ran the command "netdom TRUST AD.SCHOOL.EDU /Domain:SCHOOL.EDU /Add
/Realm /PasswordT:"Someolpswd"
3. ran the command "netdom TRUST AD.SCHOOL.EDU /Domain:SCHOOL.EDU
/Transitive:yes"
4. Restarted the AD server
Kerberos Server
1. ran the command kadmin: addprinc -e des-cbc-crc:normal
krbtgt/ad.school.edu
2. entered in "Someolpswd" when prompted for the password
3. added to the hosts file "<ip address> ad.school.edu ad"
4. added to the krb5.conf file:
[realms]
AD.SCHOOL.EDU = {
kdc = dc.ad.school.edu
admin_server = dc.ad.school.edu
}
[domain_realm]
.ad.school.edu = AD.SCHOOL.EDU
When looking at the logs, we get the following information:
Mar 14 16:10:19 kerberos.school.edu krb5kdc[15690](info): AS_REQ (7 etypes
{23 -133 -128 3 1 24 -135}) 128.128.128.128(88): ISSUE: authtime 1110838219,
etypes {rep=3 tkt=16 ses=1}, user@SCHOOL.EDU for krbtgt/SCHOOL.EDU@SCHOOL.EDU
Mar 14 16:10:19 kerberos.school.edu krb5kdc[15690](info): TGS_REQ (5 etypes
{23 3 1 24 -135}) 128.128.128.128(88): UNKNOWN_SERVER: authtime 1110838219,
user@SCHOOL.EDU for krbtgt/AD.UMN.EDU@SCHOOL.EDU, Server not found in Kerberos
database
Any ideas on why we are getting the error "Server not found in Kerberos
database"?
Thanks,
-Jeremy J. Casper
casper@umn.edu
Office of Information Technology
University of Minnesota
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
------=_NextPart_000_0000_01C528C8.D520E440
Content-Type: application/x-pkcs7-signature;
name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="smime.p7s"
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIJVDCCAtww
ggJFoAMCAQICAw4DNjANBgkqhkiG9w0BAQQFADBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhh
d3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVt
YWlsIElzc3VpbmcgQ0EwHhcNMDUwMjExMDUxNTQ4WhcNMDYwMjExMDUxNTQ4WjBVMQ4wDAYDVQQE
EwVXZWlzczEPMA0GA1UEKhMGV2FsdGVyMRUwEwYDVQQDEwxXYWx0ZXIgV2Vpc3MxGzAZBgkqhkiG
9w0BCQEWDHd1dzFAcHN1LmVkdTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL+j8Yl9
xM2t/2rjvonvi/LLFQqtP0KqfGsqTMAgQw7yRrvzHMYNxe7u38lzyZFnYqZ2wSfau1djr3LaZIgx
Ejx06MFDi08NVspVHWeP/88TB20D2JyI3Lj0P0D5pw6/pay/POGdeEBOXrFyq80RGAgVDmOGsrwp
4E7f8mjWZK0ukv6oj67JzU5vH1LkCx/hqOpTufClps5rsbiv+jB+LVJXEjd0C1mFUrDao1/CUua8
bW91AzFtA8JA95cKJl7463xzZ3UL22hnWMZaPdc3+HjThnfTFKxqajwSaKNlGCxcTvHMPfXI3n1A
DyUgrk/B5x2kZ47hvni4LolBl4sLp3cCAwEAAaMpMCcwFwYDVR0RBBAwDoEMd3V3MUBwc3UuZWR1
MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEEBQADgYEAHbD4hutEVPllQO/gZKwL7OR5c06shS6s
3BavfWNd0Y9jipIrnlA98v/pipJHLfcGpU0YB2nPvGCtBeTanpKO9lLumO0FUKCeom4IPSNEAyT0
yBUQmwT9Z+ps7kOJ+oXZu8c4qN/ymts3J/h4GJuDhGwHI6+8hHAKbg47Supa5hEwggMtMIIClqAD
AgECAgEAMA0GCSqGSIb3DQEBBAUAMIHRMQswCQYDVQQGEwJaQTEVMBMGA1UECBMMV2VzdGVybiBD
YXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAYBgNVBAoTEVRoYXd0ZSBDb25zdWx0aW5nMSgwJgYD
VQQLEx9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMSQwIgYDVQQDExtUaGF3dGUgUGVy
c29uYWwgRnJlZW1haWwgQ0ExKzApBgkqhkiG9w0BCQEWHHBlcnNvbmFsLWZyZWVtYWlsQHRoYXd0
ZS5jb20wHhcNOTYwMTAxMDAwMDAwWhcNMjAxMjMxMjM1OTU5WjCB0TELMAkGA1UEBhMCWkExFTAT
BgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYDVQQKExFUaGF3dGUg
Q29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjEkMCIG
A1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIENBMSswKQYJKoZIhvcNAQkBFhxwZXJzb25h
bC1mcmVlbWFpbEB0aGF3dGUuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDUadfUsJRk
W3HpR9gMUbbqcpGwhF59LQ2PexLfhSV1KHQ6QixjJ5+Ve0vvfhmHHYbqo925zpZkGsIUbkSsfOaP
6E0PcR9AOKYAo4d49vmUhl6t6sBeduvZFKNdbnp8DKVLVX8GGSl/npom1Wq7OCQIapjHsdqjmJH9
edvlWsQcuQIDAQABoxMwETAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBBAUAA4GBAMfskn5O
+PWWpWdiKqTwTRFg0G+NYFhhrCa7UjVcCM8w+6hKloofYkIjjBcP9LpknBesRynfnZhe0mxgcVyi
rNx54+duAEcftQ0o6AKd5Jr9E/Sm2Xyx+NxfIyYJkYBz0BQb3kOpgyXy5pwvFcr+pquKB3WLDN1R
hGvk+NHOd6KBMIIDPzCCAqigAwIBAgIBDTANBgkqhkiG9w0BAQUFADCB0TELMAkGA1UEBhMCWkEx
FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMRowGAYDVQQKExFUaGF3
dGUgQ29uc3VsdGluZzEoMCYGA1UECxMfQ2VydGlmaWNhdGlvbiBTZXJ2aWNlcyBEaXZpc2lvbjEk
MCIGA1UEAxMbVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIENBMSswKQYJKoZIhvcNAQkBFhxwZXJz
b25hbC1mcmVlbWFpbEB0aGF3dGUuY29tMB4XDTAzMDcxNzAwMDAwMFoXDTEzMDcxNjIzNTk1OVow
YjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAq
BgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMIGfMA0GCSqGSIb3DQEB
AQUAA4GNADCBiQKBgQDEpjxVc1X7TrnKmVoeaMB1BHCd3+n/ox7svc31W/Iadr1/DDph8r9RzgHU
5VAKMNcCY1osiRVwjt3J8CuFWqo/cVbLrzwLB+fxH5E2JCoTzyvV84J3PQO+K/67GD4Hv0CAAmTX
p6a7n2XRxSpUhQ9IBH+nttE8YQRAHmQZcmC3+wIDAQABo4GUMIGRMBIGA1UdEwEB/wQIMAYBAf8C
AQAwQwYDVR0fBDwwOjA4oDagNIYyaHR0cDovL2NybC50aGF3dGUuY29tL1RoYXd0ZVBlcnNvbmFs
RnJlZW1haWxDQS5jcmwwCwYDVR0PBAQDAgEGMCkGA1UdEQQiMCCkHjAcMRowGAYDVQQDExFQcml2
YXRlTGFiZWwyLTEzODANBgkqhkiG9w0BAQUFAAOBgQBIjNFQg+oLLswNo2asZw9/r6y+whehQ5aU
nX9MIbj4Nh+qLZ82L8D0HFAgk3A8/a3hYWLD2ToZfoSxmRsAxRoLgnSeJVCUYsfbJ3FXJY3dqZw5
jowgT2Vfldr394fWxghOrvbqNOUQGls1TXfjViF4gtwhGTXeJLHTHUb/XV9lTzGCA1AwggNMAgEB
MGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4x
LDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAgMOAzYwCQYFKw4D
AhoFAKCCAbwwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDUwMzE1
MDAwNTQ4WjAjBgkqhkiG9w0BCQQxFgQUgjZn443z/0ywKTblM6+bjj25GIIwZwYJKoZIhvcNAQkP
MVowWDAKBggqhkiG9w0DBzAOBggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcw
DQYIKoZIhvcNAwICASgwBwYFKw4DAhowCgYIKoZIhvcNAgUweAYJKwYBBAGCNxAEMWswaTBiMQsw
CQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UE
AxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECAw4DNjB6BgsqhkiG9w0BCRAC
CzFroGkwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0
ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAgMOAzYwDQYJ
KoZIhvcNAQEBBQAEggEAs2ddvOoovehOqVF/VNWKK2KpYi/7axbKSnirdJvQoe21Rwz6cYzkAtsx
1mh5218vjlhud11yemDmUA2ZMx/d5VdBso7HWGGVopbH0Mg74jPx9BASMHtu6t7bcFHp0zGWUO3C
iZLahxmpY8uKNz8uR/gNfKVvYZ5i0IKjYSNWkb/zCEdcJQULwXaoho2dcHqTzVdws4dR9DxGADtV
i0R2d8YSDwNkAiyTpgSZcwRR0gsg3fi/DowARfT3xCbgFZRh7Hu3nt8NrERM36TIXfndeLX23wgE
Wwyh72QowSg62jPnxeLC2vSXflveJb5j4yLe1d3J9iqI03dH1ywR+F/F8gAAAAAAAA==
------=_NextPart_000_0000_01C528C8.D520E440--
--===============068614387827873546==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============068614387827873546==--
