[37895] in Kerberos
Mimicking AD's Kerberos Forest Search Order (KFSO) with MIT Kerberos
daemon@ATHENA.MIT.EDU (Osipov, Michael)
Wed Mar 15 08:15:33 2017
From: "Osipov, Michael" <michael.osipov@siemens.com>
To: "kerberos@mit.edu" <kerberos@mit.edu>
Date: Wed, 15 Mar 2017 12:15:11 +0000
Message-ID: <68644224DA0DE64CA5A49838ED219A0425C0F075@DEFTHW99EJ5MSX.ww902.siemens.net>
Content-Language: de-DE
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Hi folks,
we are experiencing a problem with an insufficient Kerberos setup on Active Directory
side which can be solved on Windows-side with Kerberos Forest Search Order [1].
What Windows basically does is to traverse a list of Kerberos realms to obtain a
service ticket for a specific SPN where a forest (realm) feels responsible for.
Let me go in detail with a realworld example:
Two forests (realms): AD001.COMPANY.NET and COMPANY.NET whereas the latter has 20
subrealms, e.g., OLD4.COMPANY.NET.
Client account: michael-o@OLD4.COMPANY.NET
Target server is hostabc.ad001.company.net, but also has the A record
app.workspace.company.com, and of course the SPN HTTP/app.workspace.company.com.
Now both forest are set to be responsible for DNS namespace company.com.
So when michael-o@OLD4.COMPANY.NET issues a TGS-REQ to OLD4.COMPANY.NET for
HTTP/app.workspace.company.com it receives "Server not found in Kerberos database"
which makes sense here. Using a client principal from AD001.COMPANY.NET works
flawlessly. So KFSO would traverse AD001.COMPANY.NET too for the OLD1.COMPANY.NET
client principal on Windows with SSPI.
MIT Kerberos isn't capable to make use of such a logic because there is none. What
I have done is to define "app.workspace.company.com = AD001.COMPANY.NET" in the
[domain_realm], but I don't like this because to do this for every single target I
want to access and on every single server we have in our server room.
Is there a better way to solve this issue?
FWIW: We are running MIT Kerberos 1.13.x/1.15.x on FreeBSD, HP-UX and RHEL6.
Wirshark pcaps are available privately.
Best regards,
Michael
[1] https://technet.microsoft.com/de-de/library/configure-kerberos-forest-search-order-kfso(v=ws.10).aspx
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
