[18894] in Kerberos_V5_Development
Re: Possible to retrieve names of groups from PAC data?
daemon@ATHENA.MIT.EDU (Nico Williams)
Tue Jul 8 14:39:42 2014
MIME-Version: 1.0
In-Reply-To: <E1X4Zzi-005aBH-A9@intern.SerNet.DE>
Date: Tue, 8 Jul 2014 13:39:27 -0500
Message-ID: <CAK3OfOgc9hzUOL_TvnpY27-BMyKXAnKCyPmqiozAJ0guez8mAg@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: Volker.Lendecke@sernet.de
Cc: "krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Tue, Jul 8, 2014 at 1:19 PM, Volker Lendecke
<Volker.Lendecke@sernet.de> wrote:
> On Tue, Jul 08, 2014 at 11:08:27AM -0500, Nico Williams wrote:
>> It's also possible to use LDAP for SID->name lookups. In any case,
>> no, the Kerberos stack doesn't provide any SID->name lookups today.
>
> That's true, but LSA and CrackNames make it a lot easier in
> trusted domain scenarios. The DC you're joined to will also
> resolve names from trusted domain's SIDs, which might be
> impossible to you due to firewall or other access
> restrictions.
The DC will also have better caching. LSARPC is best for performance,
but I have successfully used LDAP for this (and in an async manner
too). I did it because at the time I didn't have an LSARPC client,
but did have an LDAP library :) Fun times.
Nico
--
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
