[32400] in Kerberos
Re: Any way to propagate db
daemon@ATHENA.MIT.EDU (Techie)
Wed Jun 2 14:44:19 2010
MIME-Version: 1.0
In-Reply-To: <8739x58fkp.fsf@windlord.stanford.edu>
Date: Wed, 2 Jun 2010 11:44:14 -0700
Message-ID: <AANLkTikvhfnHxbTN8Z6mMJQK8bdXwgWELh7WfIFKjtXm@mail.gmail.com>
From: Techie <techchavez@gmail.com>
To: Russ Allbery <rra@stanford.edu>
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="utf-8"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
On Wed, Jun 2, 2010 at 11:17 AM, Russ Allbery <rra@stanford.edu> wrote:> Simo Sorce <ssorce@redhat.com> writes:>> "Wilper, Ross A" <rwilper@stanford.edu> wrote:>>>> That is true.. I oversimplified a bit. This would allow you to have a>>> KDC with equivalent principals. You would need a trust relationship and>>> the external principal names set on the AD users as alternate security>>> identities for the synchronized principals to work for Windows logon,>>> etc. I had simply assumed this scenario.>>> Not sufficient, you need to provide a PAC for Windows Logons to work>> using principals from the MIT Realm.>> Given that we do this routinely at Stanford using cross-realm trust> exactly as Ross describes, I think you've misunderstood something. I> believe AD adds the PAC for you when you do what Ross says and configure> the external principal names as alternate security identities..>> --> Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>Ok now we are rolling. So let me as you guys this.With FreeIPA can I use an existing Active Directory KRB Realm and DNSenvironment instead of setting up my own. If so i would like to dothat if possible.I mean ideally I would like to use an MIT KRB environment but with theaccounts in AD it seems like it's not an option> ________________________________________________> Kerberos mailing list Kerberos@mit.edu> https://mailman.mit.edu/mailman/listinfo/kerberos>
________________________________________________Kerberos mailing list Kerberos@mit.eduhttps://mailman.mit.edu/mailman/listinfo/kerberos
