[33480] in Kerberos
Re: Cross-realm between Windows Server 2008 R2
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Wed Jun 15 10:01:54 2011
Message-ID: <4DF8BB4B.3020501@anl.gov>
Date: Wed, 15 Jun 2011 09:01:47 -0500
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: kerberos@mit.edu
In-Reply-To: <BANLkTinypXmV7SvnUiYhcBn=0Da7=E4fBQ@mail.gmail.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 6/14/2011 4:11 AM, jm130794 wrote:
> Hello,
>
> I have a little question : is it possible create a cross-realm between AD
> (Windows Server 2008 R2) and MIT Kerberos ?
>
> I tried but...
Are you able to go the other way, with a Windows user accessing a server
in the Kerberos realm?
You did not say how you set up cross realm.
>
> When I try to connect on Windows Server with my Kerberos MIT user, I get
> these errors in krb5kdc.log :
>
> Jun 14 09:22:29 srv1 krb5kdc[979](info): AS_REQ (7 etypes {18 17 23 3 1 24
> -135}) 192.168.2.2: NEEDED_PREAUTH: user1@TEST.FR for krbtgt/TEST.FR@TEST.FR,
> Additional pre-authentication required
> Jun 14 09:22:29 srv1 krb5kdc[979](info): AS_REQ (7 etypes {18 17 23 3 1 24
> -135}) 192.168.2.2: ISSUE: authtime 1308036149, etypes {rep=18 tkt=18
> ses=18}, user1@TEST.FR for krbtgt/TEST.FR@TEST.FR
> Jun 14 09:22:29 srv1 krb5kdc[979](info): TGS_REQ (7 etypes {18 17 23 3 1 24
> -135}) 192.168.2.2: ISSUE: authtime 1308036149, etypes {rep=18 tkt=18
> ses=18}, user1@TEST.FR for krbtgt/AD.TEST.FR@TEST.FR
This last one looks correct, but it is using an AES-256 key. If your W2008 r2
is still running at 2003 level, the AD may be expecting arcfour keys.
A Wireshark trace of the KRB5 packets would show a lot more info,
such as what did the client do with this cross realm TGT?
Did it try and use it to get a service ticket from AD?
And what did AD do with it?
For windows services, AD will want to add a PAC to the ticket,
with UUID and GUID info for the user. So the KRB5 users will need
accounts in AD to use AD services.
>
> Any ideas ?
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
