[27385] in Kerberos
Re: kinit fails against active directory 2003-sp2 when user has >
daemon@ATHENA.MIT.EDU (Douglas E. Engert)
Mon Feb 5 14:20:13 2007
Message-ID: <45C78351.9020709@anl.gov>
Date: Mon, 05 Feb 2007 13:19:45 -0600
From: "Douglas E. Engert" <deengert@anl.gov>
MIME-Version: 1.0
To: Jeff Saxton <jeff.saxton@sensage.com>
In-Reply-To: <45C77D6D.4000701@sensage.com>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Jeff Saxton wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I am seeing kinit fail
Which kinit? MIT? Heimdal? What version?
> against M$ Active directory when the
> user has > ~35 group memberships. anyone else seen this?
The ticket contains the Microsoft PAC, i.e. user and group authz information.
The ticket can get quite large. Even Microsoft has set a limit
that gets bigger with each release.
Google for this: site:microsoft.com PAC size
Which will lead to among other things:
http://support.microsoft.com/kb/327825
http://support.microsoft.com/kb/832572
>
> kinit(v5): ASN.1 encoding ended unexpectedly while getting initial credentials
This sounds like an ASN.1 parser problem with a large PAC.
>
> when the number of group memberships are reduced to < 20 it works!
>
> - --
> Jeffrey Mark Saxton
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFFx31tDyIrHU4I55kRAqoQAJ97Q0fP8AR/jQ/ly0LDn4o2Zh6EYQCeK8iJ
> 7gU9Y+6oNyRUdcFkFWN7c6U=
> =3N+0
> -----END PGP SIGNATURE-----
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
>
--
Douglas E. Engert <DEEngert@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
