[27737] in Kerberos
Re: Cross Realm MIT <-> Windows Close But No Cigar
daemon@ATHENA.MIT.EDU (Christopher D. Clausen)
Thu May 3 21:32:11 2007
Message-ID: <98E736469AD34803B65FA4D1D53AE929@CDCHOME>
From: "Christopher D. Clausen" <cclausen@acm.org>
To: "Michael B Allen" <mba2000@ioplex.com>
Date: Thu, 3 May 2007 20:31:55 -0500
Cc: kerberos@mit.edu
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Michael B Allen <mba2000@ioplex.com> wrote:
> On Thu, 3 May 2007 23:33:29 +0100
> "Markus Moeller" <huaraz@moeller.plus.com> wrote:
>
>> What does sshd -ddde show when you connect ? Do you use a .k5login
>> or auth_to_local ?
>
> Hi Markus,
>
> I'm not familiar with .k5login or auth_to_local. The only thing I
> changed in sshd_config was I turned of UsePAM.
Kerberos only handles authentication. You need something for
authorization. By default, the kerberos libraries will match principals
in the local default realm to local users. (principal == local user
name.) cclausen@DEFAULT.REALM can login as cclausen.
cclausen@FOREIGN.REALM cannot login without authorization.
> I actually think the trust is valid. I've been trying it with my HTTP
> SSO code and the GSS calls are definitely succeeding. It's something
> that happends after the auth (e.g. RC4 salting or session key
> problem).
Setting up a trust does NOT automatically grant authorization for the
foreign realm. Try creating a ~/.k5login file in the home directory of
the user you are logging in as listing authorized Kerberos principals,
one per line.
(AD.UIUC.EDU is a Windows AD domain. ILLIGAL.UIUC.EDU is a MIT realm.)
For instance:
C:\>klist
Ticket cache: API:cclausen@AD.UIUC.EDU
Default principal: cclausen@AD.UIUC.EDU
Valid starting Expires Service principal
05/03/07 20:26:36 05/04/07 06:26:36 krbtgt/AD.UIUC.EDU@AD.UIUC.EDU
C:\>putty ial.illigal.uiuc.edu
C:\>klist
Ticket cache: API:cclausen@AD.UIUC.EDU
Default principal: cclausen@AD.UIUC.EDU
Valid starting Expires Service principal
05/03/07 20:26:36 05/04/07 06:26:36 krbtgt/AD.UIUC.EDU@AD.UIUC.EDU
05/03/07 20:26:36 05/04/07 06:26:36
krbtgt/ILLIGAL.UIUC.EDU@AD.UIUC.EDU
05/03/07 20:26:58 05/04/07 06:26:36
host/ial.illigal.uiuc.edu@ILLIGAL.UIUC.EDU
On the remote system:
cclausen@ial:~$ cat .k5login
cclausen@ILLIGAL.UIUC.EDU
cclausen@AD.UIUC.EDU
cclausen@ial:~$ klist
Ticket cache: FILE:/tmp/krb5cc_1000_L30429
Default principal: cclausen@AD.UIUC.EDU
Valid starting Expires Service principal
05/03/07 20:26:58 05/04/07 06:26:36 krbtgt/AD.UIUC.EDU@AD.UIUC.EDU
cclausen@ial:~$ cat /etc/krb5.conf | grep default
[libdefaults]
default_realm = ILLIGAL.UIUC.EDU
cclausen@ial:~$
<<CDC
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
