[28166] in Kerberos
Re: SSO Fails on XP SP2
daemon@ATHENA.MIT.EDU (Miguel Sanders)
Wed Aug 1 05:20:43 2007
From: Miguel Sanders <miguelsanders@telenet.be>
Date: Wed, 01 Aug 2007 02:11:49 -0700
Message-ID: <1185959509.025577.286370@w3g2000hsg.googlegroups.com>
Mime-Version: 1.0
X-Complaints-To: groups-abuse@google.com
In-Reply-To: <mailman.62.1185917112.4012.kerberos@mit.edu>
Complaints-To: groups-abuse@google.com
To: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Ok I narrowed the problem.
It seems that whever the user has more than 20 groups, SSO on XP2
won't work. Below 20 groups it works OK. In XP1 there is no problem on
the amount of group memberhips. I assume that the Cross Realm Object
needs the NO_AUTH_REQUIRED field set in userAccountControl. However
the DNS admin reports that he gets "Access Denied" when trying to edit
that field of the Cross Realm object...
On 31 jul, 23:24, "Markus Moeller" <hua...@moeller.plus.com> wrote:
> Can you add the SPN with REALM into the SPN field under ssh->GSSAPI e.g.
>
> host/server.com@REALM
>
> I think Vintella is adding the default domain otherwise. Not sure if that is
> a bug or if I missed configuration setting.
>
> Markus
>
> "Miguel Sanders" <miguelsand...@telenet.be> wrote in message
>
> news:1185858011.253554.141040@b79g2000hse.googlegroups.com...
>
>
>
> >I see that I receive the cross realm ticket.
> > However I don't receive any service ticket!
>
> > On 30 jul, 21:53, "Markus Moeller" <hua...@moeller.plus.com> wrote:
> >> Can you use kerbtray to see if you get the service principal ?
>
> >> Markus
>
> >> "Miguel Sanders" <miguelsand...@telenet.be> wrote in message
>
> >>news:1185823586.577161.78640@l70g2000hse.googlegroups.com...
>
> >> > Markus, I already tried editing that setting but no luck either...
> >> > Everytime I think I am done with this setup, there is a new issue...
> >> > However, the SSO from the Linux clients to the UNIX KDCs worked
> >> > instantly!
>
> >> > On 30 jul, 20:52, "Markus Moeller" <hua...@moeller.plus.com> wrote:
> >> >> You might need this:
>
> >> >> "This new feature has been seen in Windows 2003 Server, Windows 2000
> >> >> Server
> >> >> SP4, and Windows XP SP2. We assume that it will be implemented in all
> >> >> future Microsoft operating systems supporting the Kerberos SSPI.
> >> >> Microsoft
> >> >> does work closely with MIT and has provided a registry key to disable
> >> >> this
> >> >> new feature.
>
> >> >> HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
> >> >> AllowTGTSessionKey = 0x01 (DWORD)On Windows XP SP2 the key is
> >> >> specified
> >> >> as
>
> >> >> HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos
> >> >> AllowTGTSessionKey =
> >> >> 0x01 (DWORD)"as described
> >> >> herehttp://web.mit.edu/kerberos/kfw-2.6/kfw-2.6.5/relnotes.html#mslsa
>
> >> >> Regards
> >> >> Markus
>
> >> >> "Miguel Sanders" <miguelsand...@telenet.be> wrote in message
>
> >> >>news:1185818694.532130.67160@g4g2000hsf.googlegroups.com...
>
> >> >> > Dear all
>
> >> >> > I don't know whether or not I should post this here or in
> >> >> > microsoft.xp.client but I will do both.
> >> >> > After successfully implementing a cross realm trust between AD and a
> >> >> > UNIX realm, it seems that the clients that user SP1 can successfully
> >> >> > have SSO to the UNIX machine whereas the SP2 people can't. Can
> >> >> > anyone
> >> >> > help me out, since I am not a Windows expert :-)
> >> >> > The tool I use for SSO on the Windows clients is Vintella Putty 0.60
> >> >> > q1.129.
>
> >> >> > Kind regards
>
> >> >> > Miguel
>
> >> >> > ________________________________________________
> >> >> > Kerberos mailing list Kerbe...@mit.edu
> >> >> >https://mailman.mit.edu/mailman/listinfo/kerberos-Tekstuit
> >> >> >oorspronkelijk bericht niet weergeven -
>
> >> >> - Tekst uit oorspronkelijk bericht weergeven -
>
> >> > ________________________________________________
> >> > Kerberos mailing list Kerbe...@mit.edu
> >> >https://mailman.mit.edu/mailman/listinfo/kerberos-Tekst uit
> >> >oorspronkelijk bericht niet weergeven -
>
> >> - Tekst uit oorspronkelijk bericht weergeven -
>
> > ________________________________________________
> > Kerberos mailing list Kerbe...@mit.edu
> >https://mailman.mit.edu/mailman/listinfo/kerberos- Tekst uit oorspronkelijk bericht niet weergeven -
>
> - Tekst uit oorspronkelijk bericht weergeven -
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
