[11466] in Kerberos-V5-bugs
[krbdev.mit.edu #6687] SVN Commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Fri Mar 19 23:50:09 2010
Mail-followup-to: rt@krbdev.mit.edu
mail-copies-to: never
From: "Greg Hudson via RT" <rt-comment@krbdev.MIT.EDU>
In-Reply-To: <rt-6687@krbdev.mit.edu>
Message-ID: <rt-6687-32626.15.2020508105149@krbdev.mit.edu>
To: "'AdminCc of krbdev.mit.edu Ticket #6687'":;"'AdminCc of krbdev.mit.edu Ticket #6687'":;@MIT.EDU
Date: Fri, 19 Mar 2010 23:50:07 -0400 (EDT)
Reply-To: rt-comment@krbdev.MIT.EDU
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
KRB5_AUTHDATA_SIGNTICKET, originally a Heimdal authorization data
type, was used to implement PAC-less constrained delegation in krb5
1.8. Unfortunately, it was found that Microsoft was using 142 for
other purposes, which could result in a ticket issued by an MIT or
Heimdal KDC being rejected by a Windows Server 2008 R2 application
server. Because KRB5_AUTHDATA_SIGNTICKET is only used to communicate
among a realm's KDCs, it is relatively easy to change the number, so
MIT and Heimdal are both migrating to a new number. This change will
cause a transitional interoperability issue when a realm mixes MIT
krb5 1.8 (or Heimdal 1.3.1) KDCs with MIT krb5 1.8.1 (or Heimdal
1.3.2) KDCs, but only for constrained delegation evidence tickets.
http://src.mit.edu/fisheye/changelog/krb5/?cs=23821
Commit By: ghudson
Revision: 23821
Changed Files:
U trunk/src/include/krb5/krb5.hin
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
