[27728] in Kerberos
Re: Mod_auth_kerb and Windows XP SP2
daemon@ATHENA.MIT.EDU (SriramG)
Tue May 1 22:08:17 2007
Message-ID: <10279081.post@talk.nabble.com>
Date: Tue, 1 May 2007 19:08:05 -0700 (PDT)
From: SriramG <sgopalan@etrade.com>
To: kerberos@mit.edu
In-Reply-To: <10028733.post@talk.nabble.com>
MIME-Version: 1.0
X-Nabble-From: sgopalan@etrade.com
Content-Type: text/plain; charset="utf-8"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Just wanted to update back, if anyone ends up with this issue.
We contacted MS they provided a hotfix as mentioned on the KB
http://support.microsoft.com/kb/906524/en-us
We have installed in 3 desktops. No more authentication prompts. It worksevery single time. No issues so far (10 days). I haven't rebooted or loggedoff the desktop yet in the last 10 days. I just lockout the desktop when Iam not using it. We are planning to push this to 100+ desktops next week. Will post back theresults.
--Sriram
SriramG wrote:> > Allen,> > Thanks for you response.> 1. I have seen auth dialog pops up on FF and IE after ctrl-alt-del (1> hour). But, its not consistent. > 2. If I leave my desktop idle for 10 mins, out corporate policy locks the> desktop, but it doesn’t create a new ticket when I unlock it. > Not sure if that’s controlled by GPO.> 3. For sure it creates a new TGT or renews the TGT when I manually lock> and unlock.> > Next time when this happens I will run the klist and check the ticket> EndTime.> > I was able to confirmed that, if the server is IIS it switch to NTLM on> this scenario, where as mod_auth_kerb doesn’t support NTLM.> > Actually we are seeing the same symptoms as mentioned in the KB article.> http://support.microsoft.com/kb/885887> But the DLL version I have here is 5.1.2600.2698. Which is higher than> whats mentioned on the article.> > --Sriram> > > Michael B Allen wrote:>> >>> > On the kerbtray I can see a valid ticket (non-expired).>>> > If the user locks the desktop(ctrl-alt-del) and unlocks it its starts>>> > working fine again.>> >> The TGT is expiring. TGT tickets have a "cumulative ticket life" that>> is limited by ticket renewal policy. When it expires the secret key is>> required to get a new one (e.g. the password via ctrl-alt-del).>> >> Look at the Renew Until field in kerbtray. Note that kerbtray does not>> update automatically. You must close it and relaunch it for it to update>> the information. I think you'll find that the Renew Until time is about>> 2 days.>> >> By default Windows will lock the desktop after a short time of inactivity>> so you're seeing this problem because you have somehow bypassed that>> policy. Or you have been working for two days straight in which case>> you have bigger problems than Kerberos ticket renewal policies - you>> need a new employer ;-)>> >> Mike>> >> -->> Michael B Allen>> PHP Active Directory Kerberos SSO>> http://www.ioplex.com/>> ________________________________________________>> Kerberos mailing list Kerberos@mit.edu>> https://mailman.mit.edu/mailman/listinfo/kerberos>> >> > >
-- View this message in context: http://www.nabble.com/Mod_auth_kerb-and-Windows-XP-SP2-tf3586194.html#a10279081Sent from the Kerberos - General mailing list archive at Nabble.com.
________________________________________________Kerberos mailing list Kerberos@mit.eduhttps://mailman.mit.edu/mailman/listinfo/kerberos
