[18885] in Kerberos_V5_Development
Re: communications with KDC in calling krb5_get_init_creds_password()
daemon@ATHENA.MIT.EDU (Greg Hudson)
Wed Jun 25 15:45:47 2014
Message-ID: <53AB26E2.5020803@mit.edu>
Date: Wed, 25 Jun 2014 15:45:38 -0400
From: Greg Hudson <ghudson@mit.edu>
MIME-Version: 1.0
To: Bin Lu <blu@paloaltonetworks.com>, "krbdev@mit.edu" <krbdev@mit.edu>
In-Reply-To: <841A051D8BD4144AA7B5AC63D97F9F05B28076@sjccmbxpw01p.paloaltonetworks.local>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 06/25/2014 03:05 PM, Bin Lu wrote:
> 1. Why the API needs to talk to KDC twice in order to validate the password? As I understand all it needs is to check if it can decrypt the TGS session key returned in the 1st response.
If the KDC requires preauthentication for that principal, two
round-trips are usually needed. The first reply indicates what preauth
mechanisms the KDC supports, and the second contains the actual ticket.
> 2. What data it receives from KDC would cause response TOO BIG in this API, the credential?
Probably a large PAC
(http://msdn.microsoft.com/en-us/library/cc237917.aspx) in the
authorization data of the ticket.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
