[37060] in Kerberos
Re: A client name with an '@'
daemon@ATHENA.MIT.EDU (Nico Williams)
Wed Jun 3 12:42:21 2015
Date: Wed, 3 Jun 2015 11:42:03 -0500
From: Nico Williams <nico@cryptonector.com>
To: "Nordgren, Bryce L -FS" <bnordgren@fs.fed.us>
Message-ID: <20150603164202.GA18760@localhost>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <82E7C9A01FD0764CACDD35D10F5DFB6E7E1396@001FSN2MPN1-046.001f.mgd2.msft.net>
Cc: Ken Hornstein <kenh@cmf.nrl.navy.mil>,
"kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Wed, Jun 03, 2015 at 04:29:19PM +0000, Nordgren, Bryce L -FS wrote:
> Kind of moot. These smart cards are issued from GSA credentialing
> centers for USDA and certificate production is outside my sphere of
> influence. The really odd part is that the lowercase realm is encoded
> into the certificate, but the realm in Active Directory is uppercase.
> I don't know if this is some kind of oversight, some kind of
> requirement to make Active Directory canonicalize correctly, or if
> they're intentionally making it hard to use.
AD matches realms case-insensitively (though case-preserving).
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
