[19234] in Kerberos_V5_Development
Forwarded TGT with addresses?
daemon@ATHENA.MIT.EDU (Weijun Wang)
Tue Jul 21 04:48:51 2015
Message-ID: <55AE075B.9060006@oracle.com>
Date: Tue, 21 Jul 2015 16:48:27 +0800
From: Weijun Wang <weijun.wang@oracle.com>
MIME-Version: 1.0
To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
When will a TGS-REQ for a forwarded TGT include addresses?
In Java, if a client wants to request for a forwarded TGT for a service,
it will get IP address for the host, and send a TGS-REQ for the ticket
with the address so that the TGT can only be used by the service.
Due to a bug, the address(es) field is never set. I'd like to set it now
but the TGT will be useless for the service if the address is not
correct, for example, service in NAT but KDC outside.
I tried MIT krb5 and seems the client has not send the address (I
created KDC on my local machine and create a fake service/yahoo.com). Is
this always true or is there a setting? In what cases is the addresses
field used?
Thanks
Weijun
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
