[15824] in Kerberos_V5_Development
Re: kinit always specifies all available etypes in AS-REQ?
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon May 24 14:38:05 2010
From: Greg Hudson <ghudson@mit.edu>
To: Weijun Wang <Weijun.Wang@sun.com>
In-Reply-To: <434A03D1-DB8E-4FDB-904E-899E1DC7BE47@sun.com>
Date: Mon, 24 May 2010 14:38:00 -0400
Message-ID: <1274726280.2419.525.camel@ray>
Mime-Version: 1.0
Cc: "krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Mon, 2010-05-24 at 06:22 -0400, Weijun Wang wrote:
> Why can't kinit only specifies the etypes in the keytab at the
> beginning? Is this a feature or a bug?
This is a bug, or at least a missing feature. In a traditional Unix
environment, it's not really a problem, since the keytab and KDC
typically have the same set of keys. But with a Windows KDC it can be
an issue.
The logic required for this would be noticeable but not prohibitive, I
think--we'd need to iterate over the keytab and build an array of
enctypes. This is probably best done in krb5_get_init_creds_keytab() if
the caller does not specify an etype list via the gic options.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
