[18852] in Kerberos_V5_Development
Re: TGS-REP TICKET decrypting problem
daemon@ATHENA.MIT.EDU (Wang Weijun)
Fri Jun 13 01:40:51 2014
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.2\))
From: Wang Weijun <weijun.wang@oracle.com>
In-Reply-To: <CAKSryKVC9QjNFgivVJ4fnYA=wy45vY-7L1d4+uVkBq9w=6Qzxg@mail.gmail.com>
Date: Fri, 13 Jun 2014 13:40:46 +0800
Message-Id: <0B2317B2-D1C1-4AFC-923C-F70F07759C79@oracle.com>
To: somenath saha <saha.somenath.88@gmail.com>
Cc: Danilo Almeida <dalmeida@mit.edu>, "krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
The service ticket is meant to be read by the service. The client should not be able to decrypt it.
--Max
On Jun 13, 2014, at 13:11, somenath saha <saha.somenath.88@gmail.com> wrote:
> hi wang,
>
> yes i can create keytab file and grab the necessary key from there. but it is not my intention. i don't want to take any help from KDC as i want to write separate code for client. why should client take the key from KDC. client have to prepare it and must decrypt the ticket..
>
>
> On Fri, Jun 13, 2014 at 10:36 AM, Wang Weijun <weijun.wang@oracle.com> wrote:
> Didn't you already created a keytab file using esedbexport and dskeytab.py? Inside it there is one key that should decrypt the service ticket.
>
> --Max
>
> On Jun 13, 2014, at 13:00, somenath saha <saha.somenath.88@gmail.com> wrote:
>
> > hi danilo and other
> >
> > I forgot to mention something about my setup. I am running an Active Directory domain on a Windows Server 2012 machine with two Windows (windows server 2012) clients joined to the domain. In windows server 2012 i create a user "krbtest" and password of this user is "Krbtest2012". now i prepare a key using the user credential i.e username "krbtest " , its password and corresponding domain and enctype. Using this key i can decrypt the AS_REP message. but i can't decrypt the TGS_REP ticket using that key. please help me out and inform me if you need any other details..
> >
> >
> > On Thu, Jun 12, 2014 at 11:59 AM, somenath saha <saha.somenath.88@gmail.com> wrote:
> > Danilo,
> >
>
>
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
