|
|
|
|
|
|
|
|
|
|
|
|
| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |
From: "Wilper, Ross A" <rwilper@stanford.edu> To: N K <nkaluskar@gmail.com>, "kerberos@MIT.EDU" <kerberos@mit.edu> Date: Tue, 3 Aug 2010 15:37:02 -0700 Message-ID: <C6BF43271ABC924B9A7057FAD2B4953F06C453E16A@ITS-ExchMB02.stanford.edu> In-Reply-To: <AANLkTi=4YNKSuezMxRqDkM+bMpDZz14VLaeWBS7kABj=@mail.gmail.com> Content-Language: en-US MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: kerberos-bounces@mit.edu Unfortunately, there are a lot of reasons that this could fail. 1) Incorrect passphrase for one of the three trust accounts 2) Enctype mismatch (by default, a new trust will only support RC4-HMAC) 3) Client machine cannot resolve the MIT KDCs 4) Duplicate mappings on user accounts in the same AD domain (do an ldap search on altSecurityIdentities) 5) You may need to set TLN mappings (referrals) on one side or the other 6) If you have multiple domains, is the realm trust set transitive? Probably more. The only times I've had failures were case #1 and #3 Also note that MIT credentials will always fail to logon to RDP when NLA is in use. -Ross -----Original Message----- From: kerberos-bounces@MIT.EDU [mailto:kerberos-bounces@MIT.EDU] On Behalf Of N K Sent: Tuesday, August 03, 2010 3:19 PM To: kerberos@MIT.EDU Subject: Establishing and verifying a trust between Unix MIT KDC and Windows Server 2003 AD Hi all, I followed the steps for a cross-realm setup between the MIT KDC and AD according to O'reilly's Definitive Guide book: - specifying KDC's using ksetup on the participating Windows machines - creating principals krbtgt/domain@realm and krbtgt/realm@domain in the MIT KDC - creating a 2 way trust in the AD - mapping an AD user to a user in the MIT KDC However, when I try to logon to the Kerberos realm from a Windows machine using the credentials of the MIT KDC user, I get an error that the system could not log me on because the username or domain is incorrect. Has anyone come across a similar problem before? Thanks much in advance, Nivedita. ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos
|
|
|
|
|
|
|
|
|
|
|
|
| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |