[8047] in Kerberos
K5B7 cross-realm
daemon@ATHENA.MIT.EDU (Doug Engert)
Thu Sep 19 12:48:07 1996
Date: Thu, 19 Sep 1996 11:34:55 -0500
From: Doug Engert <DEEngert@anl.gov>
To: Gus Massey <amassey@ntg02.gsfc.nasa.gov>
Cc: kerberos@MIT.EDU, bjaspan@MIT.EDU, authtf@es.net
In-Reply-To: <Pine.3.89.9609190836.B437-0100000@ntg02.gsfc.nasa.gov>
Gus Massey writes:
> Cross-realm wizards,
>
> With K5B6 I followed Barry Jaspan's recipe for cross-realm to work with
> little or no problem. But my testing dealt with K5B6 against another
> K5B6 realm. I have started attempting to test with a DCE realm against
> my K5B7 realm. We are in the early stages of this, and the coordination
> between the two sites is just under way. Is there any magic recipe or
> advice on how to make this work to minimize problems early on?
>
> Thanks,
>
> Gus Massey (301) 794-2523
> Computer Sciences Corporation
> Seabrook, MD
There are lots of problems in this area, dealing with checksums, and
enctypes. Don't forget that DCE 1.1 is based on kerberos from about
two years ago.
In addition DCE when doing cross-realm authentication has only one
principal its data base rather then two as K5 does.
K5 uses krbtgt/A@B and krbtgt/B@A and both KDCs have these in the
database. Each has a different key.
DCE on the other hand only has one principal for the other cell.
Cell a would have a principal krbtgt/b@a, and Cell b would have
a principal for krbtgt/a@b. They have the same key and kvno.
So to get K5 realm A to cross authenticate with DCE cell b, you need
to add krbtgt/b@A and krbtgt/A@b to the K5 database, and you need to
add into DCE a principal krbtgt/A@b. All three of these must all have
the same key and kvno. Since it is based older K5 code, the key is a
des key.
The trick is to get the same key. Since each side wants to use a salt
for the stringtokey routines based on the realm name, and each has a
different ream name, you need to use a null salt. (k4 salt on K5.)
You will need a way to add the key to DCE. I have a cpwkey.c routine
which can do this.
I have not actually done this, since we are using only DCE as the KDC,
but Gary Grider of LANL has been trying to get this to work for the last
few weeks. He has been running into problems with getting the enctypes,
checksums and other problems.
In addition DCE has a different notion of hierarchical cross-realm
authentication. Its hierarchy is not based on parsing the realm name at
the periods. It also does not currently have the configurable
authentication path code as does K5b6 and k5b7. So hierarchical
cross-realm authentication currently will not work.
I would be interested helping in this effort.
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444 <New Area Code 8/3/96>
PGP Key fingerprint = 20 2B 0C 78 43 8A 9C A6 29 F7 A3 6D 5E 30 A6 7F
