[38268] in Kerberos
Re: Why the SPN can't be arbitrary
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon Jun 25 12:18:40 2018
To: ZongtianHou <zongtianhou@icloud.com>,
"kerberos@mit.edu" <kerberos@mit.edu>
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <a2ef6b64-1206-7d76-3d3d-d89e8f4c5842@mit.edu>
Date: Mon, 25 Jun 2018 12:18:21 -0400
MIME-Version: 1.0
In-Reply-To: <126AF4E5-4348-42A9-BD90-128226727998@icloud.com>
Content-Language: en-US
Content-Type: text/plain; charset="utf-8"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
On 06/24/2018 12:27 AM, ZongtianHou wrote:
> I have some questions for the auth process. When the user get the tgt, it then send a request to the TGS in which it tell TGS the service principal it want to access. I have two questions here. First, how does the user know the service principal, I think it only know the service it want to access. Second, why the SPN must be service/FQDN@REALM.COM, if the user know the service principal, like aaa@REALM.COM. it just request a ticket for it, then send the ticket to the service, then it can access to it. What I misunderstood here?
In the Kerberos protocol itself, the service name does not have to be
service/FQDN@REALM.COM; it could be aaa@REALM.COM.
The reason why you usually see service names of the form
service/FQDN@REALM.COM is because of host-based service names in the
GSSAPI, which many applications use. For these, the application
supplies a service name (like "host" or "HTTP") and a hostname. The
Kerberos implementation then might canonicalize the hostname, and also
tries to look up what realm the host belongs to using local
configuration. If it can't figure out the realm, it will guess its
local realm and possibly receive a referral to another realm.
In your Hadoop question, from the log you provided, it looks like the
application used a host-based service name with the service "gpadmin"
and the host "CW.COM", resulting in the server principal name
"gpadmin/cw.com@CW.COM", which does not appear to be present in the KDC
database.
> It seems the kutils tools are different between the MAC and linux, and I can’t find how to use it in Mac OS in the internet. Does anyone know how to display the principals in a keytab and how to kinit a specific principal on Mac?
In macOS, the native Kerberos implementation is based on Heimdal, while
on Linux distributions it is often MIT krb5.
To list the keys in a keytab on macOS, I believe you want "ktutil list",
or "ktutil -k /path/to/keytab list".
I am not sure what you mean by "kinit a specific principal". For a
specific client principal, in both implementations you can just do
"kinit aaa@REALM.COM" or just "kinit aaa" if the default realm is
REALM.COM. For a specific service principal (i.e. not
krbtgt/REALMNAME), you can use "kinit -S servername", optionally
followed by the client name as before. Note that the client and server
principal names must be in the same realm for initial tickets.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
