[19145] in Kerberos_V5_Development
Re: S4U2self and S4U2proxy don't honor Canonicalize option
daemon@ATHENA.MIT.EDU (Greg Hudson)
Tue Mar 24 14:19:58 2015
Message-ID: <5511AA95.4020708@mit.edu>
Date: Tue, 24 Mar 2015 14:19:01 -0400
From: Greg Hudson <ghudson@mit.edu>
MIME-Version: 1.0
To: Srinivas Cheruku <srinivas.cheruku@gmail.com>,
"'krbdev@mit.edu'" <krbdev@mit.edu>
In-Reply-To: <003101d06617$25322a70$6f967f50$@gmail.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 03/24/2015 05:44 AM, Srinivas Cheruku wrote:
> I am sending S4U2self and S4U2proxy requests to MS AD (2003/2008/2012) and
> found that the client name in these tickets is not canonicalized even though
> KDC option Canonicalize is set.
> Any idea why MS AD is not canonicalizing the client name in these tickets?
I can only speculate based on the documentation, but it seems that
client name canonicalization is an AS-REQ facility, while S4U requests
are specialized TGS-REQs.
For S4U2Self I believe you are supposed to identify the client principal
name using an AS-REQ as described in [MS-S4U] section 3.1.5.1.1.1 before
making the S4U2Self TGS request.
For S4U2Proxy you present an evidence ticket which should already have a
canonicalized client name.
[MS-S4U] https://msdn.microsoft.com/en-us/library/cc246071.aspx
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
