[18895] in Kerberos_V5_Development
Re: Possible to retrieve names of groups from PAC data?
daemon@ATHENA.MIT.EDU (Volker Lendecke)
Tue Jul 8 15:03:21 2014
Date: Tue, 8 Jul 2014 20:19:58 +0200
From: Volker Lendecke <Volker.Lendecke@sernet.de>
To: Nico Williams <nico@cryptonector.com>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <CAK3OfOgJN5n9y+Mox+q7T0ToAMfpEFw1Z3KoUJhYD=zpEA8_OA@mail.gmail.com>
Message-Id: <E1X4Zzi-005aBH-A9@intern.SerNet.DE>
Cc: "krbdev@mit.edu" <krbdev@mit.edu>
Reply-To: Volker.Lendecke@sernet.de
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: krbdev-bounces@mit.edu
Content-Transfer-Encoding: 8bit
On Tue, Jul 08, 2014 at 11:08:27AM -0500, Nico Williams wrote:
> It's also possible to use LDAP for SID->name lookups. In any case,
> no, the Kerberos stack doesn't provide any SID->name lookups today.
That's true, but LSA and CrackNames make it a lot easier in
trusted domain scenarios. The DC you're joined to will also
resolve names from trusted domain's SIDs, which might be
impossible to you due to firewall or other access
restrictions.
Volker
--
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: +49-551-370000-0, fax: +49-551-370000-9
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen
http://www.sernet.de, mailto:kontakt@sernet.de
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
