[24756] in Kerberos
Re: 2k3 (SP1) and PDC Emulator difference
daemon@ATHENA.MIT.EDU (amol dixit)
Wed Sep 28 17:57:01 2005
Message-ID: <20050928215559.63484.qmail@web52401.mail.yahoo.com>
Date: Wed, 28 Sep 2005 14:55:59 -0700 (PDT)
From: amol dixit <dixitamol@yahoo.com>
To: kerberos@mit.edu
In-Reply-To: <dhevl1$fbb$1@sea.gmane.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Errors-To: kerberos-bounces@mit.edu
Markus,
There is no error per-se, since the 2k3 forwards the
ticket request (AS_REQ) to the PDC Emulator (2k
server), which authenticates using the same key. So
the salt created does work with the PDC.
To see how windows macnine accoutns are added to a
domain, I took a trace while adding a machine to the
domain, turns out, it uses SAMR and not Kerberos, so
no help.
Thanks,
Amol
--- Markus Moeller <huaraz@moeller.plus.com> wrote:
> Can you look at the error message ? I think there
> was a change in
> calculating the salt for DES keys.
>
> Regards
> Markus
>
> "amol dixit" <dixitamol@yahoo.com> wrote in message
>
news:20050928201447.43903.qmail@web52408.mail.yahoo.com...
> > Hi,
> > I have Windows 2k and 2k3 (SP1) AD servers in a
> > domain, and if I set the 2k server as the
> > OperationsMaster->PDC (aka. PDC Emulator), then
> > DES_CBC_MD5 key generated using the SPN (and
> > corresponding Salt) fails to authenticate on 2k3
> > server. It automatically forwards the kerberos
> ticket
> > request (AS_REQ) to the PDC Emulator (which is the
> 2k
> > server), which in turn authenticates the SPN using
> the
> > same key. Also, kinit can get a ticket from 2k3
> for
> > the same account without forwarding to PDC.
> > I am at a loss to explain how come the same
> kerberos
> > DES key works on 2k but not on 2k3, even though
> the
> > account is created on 2k3 AD.
> > Interestingly, if I make the 2k3 server as PDC
> master,
> > it will authenticate using the same key and not
> > forward the request to the 2k server anymore.
> > PDC emulators are for legacy windows clients, I
> dont
> > see what role is plays here.
> > Any ideas, please let me know.
> > TIA,
> > Amol
> >
> >
> >
> >
> > __________________________________
> > Yahoo! Mail - PC Magazine Editors' Choice 2005
> > http://mail.yahoo.com
> > ________________________________________________
> > Kerberos mailing list Kerberos@mit.edu
> > https://mailman.mit.edu/mailman/listinfo/kerberos
> >
>
>
>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
