[7910] in Kerberos
Re: HELP. What happens when user not found in the passwd database ...
daemon@ATHENA.MIT.EDU (Salil Dangi)
Wed Sep 4 14:27:42 1996
To: kerberos@MIT.EDU
Date: 4 Sep 1996 17:17:49 GMT
From: "Salil Dangi" <Salil.Dangi@MV.UNISYS.COM>
KDC sends Error response in clear text to indicate principal was not found.
Following is one such response :
7E81B73081B4A003020105A10302011EA211
180F31393939313230373037353832395AA411180F3139393630393034313632373031
5AA50502030BB68EA603020106A7091B074D505F53554E32A8183016A003020101A10F
300D1B0B746573742E64756D6D7930A9091B074D505F53554E32AA1C301AA003020100
A11330111B066B72627467741B074D505F53554E32AB281B26436C69656E74206E6F74
20666F756E6420696E204B65726265726F7320646174616261736500
7E tag 30 (error response)
81B7 length 183
30 sequence Tag
81B4 length 180
A003020105 Version 5
A10302011E msg_type = 30 (error_response)
A211180F....5A client KerberosTime 19991207075829Z
A411180F....5A server KerberosTime 19960904162701Z
A50502030bb68E server microSecs
A603020106 error_code = 6 [KDR_ERR_C_PRINCIPAL_UNKNOWN]
A7091B074D505F53554E32 crealm MP_SUN2
A8183016A003020101 cname type = 1, test_dummy0
A10F300D1B0B746573742E64756D6D7930
A9091B074D505F53554E32 realm MP_SUN2
AA1C301AA003020100 sname type = 0, krbtgtMP_SUN2
A11330111B066B7262746774
1B074D505F53554E32
AB281B26 e-text [Client not found in Kerberos Database]
436C69656E74206E6F7420666F756E6420696E204B65726265726F7320646174616261736500
Salil.Dangi@MV.UNISYS.COM
Dhaval M Shah <dms03@handel.cs.uow.edu.au> wrote in article
<50dq5c$gf9@handel.cs.uow.edu.au>...
> Hello everybody,
>
> I have a doubt. I am implementing a prototype of kerberos to aid students
> understand the process of how the kerberos protocol works [ A CAL tool ].
>
> In the general kerberos paradigm, the user types his name on the work
> station, the username is sent across the network to the KDC, which checks
> up the username in the password database, generates the session keys and
> TGT and other administrativia and encrypts it using the user's password
and
> sends back the token across to the workstation, which on receipt of the
> token prompts for the password and decrypts the token with the password
which
> the user enters.
>
> Now my question is, What happens if the KDC is not able to find the user
> name in its password database? Does it send something across over the
> network in clear text - like - "User Name Not found" <- well it does not,
> then how does the workstation know that the username that has been
> entered is an invalid username and not available in the database?
>
> All help is appreciated.
>
> thanks
> dhaval
> dms03@uow.edu.au
>
