[15822] in Kerberos_V5_Development
kinit always specifies all available etypes in AS-REQ?
daemon@ATHENA.MIT.EDU (Weijun Wang)
Mon May 24 06:23:08 2010
MIME-version: 1.0
Date: Mon, 24 May 2010 18:22:48 +0800
From: Weijun Wang <Weijun.Wang@sun.com>
To: krbdev@mit.edu
Message-id: <434A03D1-DB8E-4FDB-904E-899E1DC7BE47@sun.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Hi All
kinit can use a keytab file to request for a TGT. My keytab only includes keys for several etypes, but it seems kinit still includes all supported etypes in the AS-REQ message. When the KDC (Windows Server 2008) sends back the preauth challenge listing aes256-cts (which I don't have in my keytab) as the first etype in PA-ETYPE-INFO2, kinit fails saying --
kinit: Key table entry not found while getting initial credentials
If preauth is disabled, KDC simply sends back a TGT with session key encrypted with aes256-cts, and kinit shows the same error.
Why can't kinit only specifies the etypes in the keytab at the beginning? Is this a feature or a bug?
I'm using 1.7 on Ubuntu.
Thanks
Weijun
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
