[33479] in Kerberos
Re: Cross-realm between Windows Server 2008 R2
daemon@ATHENA.MIT.EDU (Lars Schimmer)
Wed Jun 15 04:30:13 2011
Message-ID: <4DF86D97.3050605@cgv.tugraz.at>
Date: Wed, 15 Jun 2011 10:30:15 +0200
From: Lars Schimmer <l.schimmer@cgv.tugraz.at>
MIME-Version: 1.0
To: kerberos@mit.edu
In-Reply-To: <BANLkTinypXmV7SvnUiYhcBn=0Da7=E4fBQ@mail.gmail.com>
X-SA-Exim-Mail-From: l.schimmer@cgv.tugraz.at
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
On 2011-06-14 11:11, jm130794 wrote:
> Hello,
>
> I have a little question : is it possible create a cross-realm between AD
> (Windows Server 2008 R2) and MIT Kerberos ?
>
> I tried but...
>
> When I try to connect on Windows Server with my Kerberos MIT user, I get
> these errors in krb5kdc.log :
>
> Jun 14 09:22:29 srv1 krb5kdc[979](info): AS_REQ (7 etypes {18 17 23 3 1 24
> -135}) 192.168.2.2: NEEDED_PREAUTH: user1@TEST.FR for krbtgt/TEST.FR@TEST.FR,
> Additional pre-authentication required
> Jun 14 09:22:29 srv1 krb5kdc[979](info): AS_REQ (7 etypes {18 17 23 3 1 24
> -135}) 192.168.2.2: ISSUE: authtime 1308036149, etypes {rep=18 tkt=18
> ses=18}, user1@TEST.FR for krbtgt/TEST.FR@TEST.FR
> Jun 14 09:22:29 srv1 krb5kdc[979](info): TGS_REQ (7 etypes {18 17 23 3 1 24
> -135}) 192.168.2.2: ISSUE: authtime 1308036149, etypes {rep=18 tkt=18
> ses=18}, user1@TEST.FR for krbtgt/AD.TEST.FR@TEST.FR
>
> Any ideas ?
We use the Win 2008R2 AD as krb5 auth. Works fine so far.
If you want to use MIT krb5 and a AD auith, both REALMs need to be
different.
MfG,
Lars Schimmer
--
-------------------------------------------------------------
TU Graz, Institut für ComputerGraphik & WissensVisualisierung
Tel: +43 316 873-5405 E-Mail: l.schimmer@cgv.tugraz.at
Fax: +43 316 873-5402 PGP-Key-ID: 0x4A9B1723
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
