[23613] in Kerberos
Re: domain realm mapping
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Fri Apr 1 07:48:58 2005
Message-ID: <424D424D.8020202@anl.gov>
Date: Fri, 01 Apr 2005 06:45:01 -0600
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: Preetam Ramakrishna <rpreetam@novell.com>
In-Reply-To: <s24cb8a8.005@lucius.provo.novell.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
Preetam Ramakrishna wrote:
> Hi,
>
> On unix machines, the kerberized client (eg: telnet) look for
> "domain realm mappings" in the /etc/krb5.conf file. So, when I run
> "telnet server-1.acme.com", the client would appropriately request the
> KDC a service ticket for host/server-1.acme.com@REALM1.COM
>
> Is there anything equivalent to this on a win2k workstation
> which is configured to be a part of the non-windows kerberos realm.
The krb5.ini on Windows is the same as a unix krb5.conf, and the KfW
Kerberos libs will use the domain realm mappings.
If you are using the windows kerberos libs, via SSPI, the
server_principal_name parameter of the InitializeSecurityContext
routine can take the form: <service>@<host>@<realm>
so the application can provide all three.
Windows also implements referrals, were the client asks the KDC
for a ticket. The KDC can then return a referral to the client to
try a different realm. But this requires (1) KDC has a data base
of host realm mappings, (2)KDC has referral code, and (3) client
understands what to do with a referral. Windows code has all three.
AD can find hosts in its forest. AFAIK, referrals are not yet implemented
in non windows Kerberos. The IETF krb-wg and Kitten WG are addressing
these issues.
SecureCRT, and PuTTY can use either MIT KfW or SSPI and can allow the user
to provide the realm when using the SSPI.
>
> Thanks,
> Preetam
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
