[25165] in Kerberos
Determining the Kerberos domain in HTTP
daemon@ATHENA.MIT.EDU (=?ISO-8859-1?Q?=22Martin_v=2E_L=F6)
Tue Dec 27 20:19:45 2005
Date: Tue, 27 Dec 2005 17:18:34 +0100
From: =?ISO-8859-1?Q?=22Martin_v=2E_L=F6wis=22?= <martin@v.loewis.de>
Message-ID: <43b1695b$0$4061$9b622d9e@news.freenet.de>
To: kerberos@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
How should a web browser determine the domain
in the SPN? More specifically, how does IE6 determine
the domain.
In our scenario, we have two AD domains: B.com,
and A.B.com. There is a unidirectional trust: A.B.com
trusts B.com. The web server is www.A.B.com; it
has a servicePrincipalName mapping in the Active
Directory, with a SPN of HTTP/www.a.b.com
A user foo@A.B.COM can readily authenticate to
the webserver.
Also, with MIT Kerberos on Linux, a user which
has a tgt for bar@B.COM can authenticate to the
webserver.
Unfortunately, bar@B.COM, can NOT authenticate
to the webserver with IE6, and neither with
Mozilla Firefox, using SSPI.
My guess is that SSPI tries to obtain a ticket
for HTTP/www.a.b.com@B.COM, when it should ask
for a ticket for HTTP/www.a.b.com@A.B.COM
(which it would get).
How can I tell IE6/SSPI/SPNEGO to go to a
different KDC for authentication?
TIA,
Martin
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
