[28177] in Kerberos
Re: SSO Fails on XP SP2
daemon@ATHENA.MIT.EDU (Jeffrey Altman)
Thu Aug 2 15:08:10 2007
Message-ID: <46B22BD2.4080202@secure-endpoints.com>
Date: Thu, 02 Aug 2007 15:09:06 -0400
From: Jeffrey Altman <jaltman@secure-endpoints.com>
MIME-Version: 1.0
To: huaraz@moeller.plus.com
In-Reply-To: <f8t8mi$jb8$1@sea.gmane.org>
X-Envelope-From: jaltman@secure-endpoints.com
X-MDaemon-Deliver-To: kerberos@mit.edu
Cc: kerberos@mit.edu
Reply-To: jaltman@secure-endpoints.com
Content-Type: multipart/mixed; boundary="===============1490525576=="
Errors-To: kerberos-bounces@mit.edu
This is a cryptographically signed message in MIME format.
--===============1490525576==
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature";
micalg=sha1; boundary="------------ms070401090806080400030004"
This is a cryptographically signed message in MIME format.
--------------ms070401090806080400030004
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Marcus:
Miguel's problem is that his Unix KDC does not support TCP connections.
Jeffrey Altman
Markus Moeller wrote:
> Miguel,
>
> I use an XP SP2 client and can't recreate your problem. I have
>
> AD <-transitive trust->MIT
> |
> XPSP2
>
> I login to my XP box with a Windows id with 25 groups. Use Vintella Putty
> to login to a Unix server which is registered on the MIT kdc and I can login
> straight away. Is that your setup or do you login to a client which is part
> of your child domain ?
>
> Thank you
> Markus
>
>
>
> "Miguel Sanders" <miguelsanders@telenet.be> wrote in message
> news:1185959509.025577.286370@w3g2000hsg.googlegroups.com...
>> Ok I narrowed the problem.
>> It seems that whever the user has more than 20 groups, SSO on XP2
>> won't work. Below 20 groups it works OK. In XP1 there is no problem on
>> the amount of group memberhips. I assume that the Cross Realm Object
>> needs the NO_AUTH_REQUIRED field set in userAccountControl. However
>> the DNS admin reports that he gets "Access Denied" when trying to edit
>> that field of the Cross Realm object...
>>
>> On 31 jul, 23:24, "Markus Moeller" <hua...@moeller.plus.com> wrote:
>>> Can you add the SPN with REALM into the SPN field under ssh->GSSAPI e.g.
>>>
>>> host/server.com@REALM
>>>
>>> I think Vintella is adding the default domain otherwise. Not sure if that
>>> is
>>> a bug or if I missed configuration setting.
>>>
>>> Markus
>>>
>>> "Miguel Sanders" <miguelsand...@telenet.be> wrote in message
>>>
>>> news:1185858011.253554.141040@b79g2000hse.googlegroups.com...
>>>
>>>
>>>
>>>> I see that I receive the cross realm ticket.
>>>> However I don't receive any service ticket!
>>>> On 30 jul, 21:53, "Markus Moeller" <hua...@moeller.plus.com> wrote:
>>>>> Can you use kerbtray to see if you get the service principal ?
>>>>> Markus
>>>>> "Miguel Sanders" <miguelsand...@telenet.be> wrote in message
>>>>> news:1185823586.577161.78640@l70g2000hse.googlegroups.com...
>>>>>> Markus, I already tried editing that setting but no luck either...
>>>>>> Everytime I think I am done with this setup, there is a new issue...
>>>>>> However, the SSO from the Linux clients to the UNIX KDCs worked
>>>>>> instantly!
>>>>>> On 30 jul, 20:52, "Markus Moeller" <hua...@moeller.plus.com> wrote:
>>>>>>> You might need this:
>>>>>>> "This new feature has been seen in Windows 2003 Server, Windows
>>>>>>> 2000
>>>>>>> Server
>>>>>>> SP4, and Windows XP SP2. We assume that it will be implemented in
>>>>>>> all
>>>>>>> future Microsoft operating systems supporting the Kerberos SSPI.
>>>>>>> Microsoft
>>>>>>> does work closely with MIT and has provided a registry key to
>>>>>>> disable
>>>>>>> this
>>>>>>> new feature.
>>>>>>> HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
>>>>>>> AllowTGTSessionKey = 0x01 (DWORD)On Windows XP SP2 the key is
>>>>>>> specified
>>>>>>> as
>>>>>>> HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos
>>>>>>> AllowTGTSessionKey =
>>>>>>> 0x01 (DWORD)"as described
>>>>>>> herehttp://web.mit.edu/kerberos/kfw-2.6/kfw-2.6.5/relnotes.html#mslsa
>>>>>>> Regards
>>>>>>> Markus
>>>>>>> "Miguel Sanders" <miguelsand...@telenet.be> wrote in message
>>>>>>> news:1185818694.532130.67160@g4g2000hsf.googlegroups.com...
>>>>>>>> Dear all
>>>>>>>> I don't know whether or not I should post this here or in
>>>>>>>> microsoft.xp.client but I will do both.
>>>>>>>> After successfully implementing a cross realm trust between AD
>>>>>>>> and a
>>>>>>>> UNIX realm, it seems that the clients that user SP1 can
>>>>>>>> successfully
>>>>>>>> have SSO to the UNIX machine whereas the SP2 people can't. Can
>>>>>>>> anyone
>>>>>>>> help me out, since I am not a Windows expert :-)
>>>>>>>> The tool I use for SSO on the Windows clients is Vintella Putty
>>>>>>>> 0.60
>>>>>>>> q1.129.
>>>>>>>> Kind regards
>>>>>>>> Miguel
>>>>>>>> ________________________________________________
>>>>>>>> Kerberos mailing list Kerbe...@mit.edu
>>>>>>>> https://mailman.mit.edu/mailman/listinfo/kerberos-Tekstuit
>>>>>>>> oorspronkelijk bericht niet weergeven -
>>>>>>> - Tekst uit oorspronkelijk bericht weergeven -
>>>>>> ________________________________________________
>>>>>> Kerberos mailing list Kerbe...@mit.edu
>>>>>> https://mailman.mit.edu/mailman/listinfo/kerberos-Tekst uit
>>>>>> oorspronkelijk bericht niet weergeven -
>>>>> - Tekst uit oorspronkelijk bericht weergeven -
>>>> ________________________________________________
>>>> Kerberos mailing list Kerbe...@mit.edu
>>>> https://mailman.mit.edu/mailman/listinfo/kerberos- Tekst uit
>>>> oorspronkelijk bericht niet weergeven -
>>> - Tekst uit oorspronkelijk bericht weergeven -
>>
>> ________________________________________________
>> Kerberos mailing list Kerberos@mit.edu
>> https://mailman.mit.edu/mailman/listinfo/kerberos
>>
>
>
>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
--------------ms070401090806080400030004
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature
MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIJeTCC
AxcwggKAoAMCAQICEALr5BE3U6n+HWCoLbyhohMwDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UE
BhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMT
I1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA3MDUzMTA2MTM1N1oX
DTA4MDUzMDA2MTM1N1owczEPMA0GA1UEBBMGQWx0bWFuMRUwEwYDVQQqEwxKZWZmcmV5IEVy
aWMxHDAaBgNVBAMTE0plZmZyZXkgRXJpYyBBbHRtYW4xKzApBgkqhkiG9w0BCQEWHGphbHRt
YW5Ac2VjdXJlLWVuZHBvaW50cy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQCsoz/0+s4Cn65n/3bU3shXw4y5u1uEMEsBOiqNU0PfIKGYQe95b1FKNbNAkctSdQT6GF5c
bhSnJPmb2OOb1frx64dlDgskaG561xa8XPA1aP8Cc+33dgsSLIxGEh97lyUYHEfWBC03KMCF
PKhZfcrGAXoVCrFBadnLAokQbUTFahVg/qQx2IT3wSj1sCIfV5UDuXcEKHCvRtEZIsSzu184
9Cj6I4nY5bt+r94kyDHM94MHYBJi+6tWLFRy2gkIB3HEPmxAiQrKljNpH9bOffiBLIAgmJ6d
1ZXepBXyexQbwOYvftpVlMEFHHQmdiwH3tj69hE78XvM5X9J+SbjbuNpAgMBAAGjOTA3MCcG
A1UdEQQgMB6BHGphbHRtYW5Ac2VjdXJlLWVuZHBvaW50cy5jb20wDAYDVR0TAQH/BAIwADAN
BgkqhkiG9w0BAQUFAAOBgQB8FShDN2Ig034Y5eyadiFDEtOvsIJ3Z2xV9aTL4u8xMlz1gZR1
AZAvCv+ZMMRRKWCsrG5tItV8DFPSfWAGMpInmMarA4f76JRLQEUhkRUg8GpkJM5ryk5EDakk
0oiBQcQD8A+UHwrcmaj3UWxQ9zCjDgU+1mY9nEQxZZyp4eeUfzCCAxcwggKAoAMCAQICEALr
5BE3U6n+HWCoLbyhohMwDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoT
HFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25h
bCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA3MDUzMTA2MTM1N1oXDTA4MDUzMDA2MTM1N1ow
czEPMA0GA1UEBBMGQWx0bWFuMRUwEwYDVQQqEwxKZWZmcmV5IEVyaWMxHDAaBgNVBAMTE0pl
ZmZyZXkgRXJpYyBBbHRtYW4xKzApBgkqhkiG9w0BCQEWHGphbHRtYW5Ac2VjdXJlLWVuZHBv
aW50cy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsoz/0+s4Cn65n/3bU
3shXw4y5u1uEMEsBOiqNU0PfIKGYQe95b1FKNbNAkctSdQT6GF5cbhSnJPmb2OOb1frx64dl
DgskaG561xa8XPA1aP8Cc+33dgsSLIxGEh97lyUYHEfWBC03KMCFPKhZfcrGAXoVCrFBadnL
AokQbUTFahVg/qQx2IT3wSj1sCIfV5UDuXcEKHCvRtEZIsSzu1849Cj6I4nY5bt+r94kyDHM
94MHYBJi+6tWLFRy2gkIB3HEPmxAiQrKljNpH9bOffiBLIAgmJ6d1ZXepBXyexQbwOYvftpV
lMEFHHQmdiwH3tj69hE78XvM5X9J+SbjbuNpAgMBAAGjOTA3MCcGA1UdEQQgMB6BHGphbHRt
YW5Ac2VjdXJlLWVuZHBvaW50cy5jb20wDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQUFAAOB
gQB8FShDN2Ig034Y5eyadiFDEtOvsIJ3Z2xV9aTL4u8xMlz1gZR1AZAvCv+ZMMRRKWCsrG5t
ItV8DFPSfWAGMpInmMarA4f76JRLQEUhkRUg8GpkJM5ryk5EDakk0oiBQcQD8A+UHwrcmaj3
UWxQ9zCjDgU+1mY9nEQxZZyp4eeUfzCCAz8wggKooAMCAQICAQ0wDQYJKoZIhvcNAQEFBQAw
gdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUg
VG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRp
b24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFp
bCBDQTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0w
MzA3MTcwMDAwMDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxU
aGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwg
RnJlZW1haWwgSXNzdWluZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV
+065yplaHmjAdQRwnd/p/6Me7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfAr
hVqqP3FWy688Cwfn8R+RNiQqE88r1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/
p7bRPGEEQB5kGXJgt/sCAwEAAaOBlDCBkTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8
MDowOKA2oDSGMmh0dHA6Ly9jcmwudGhhd3RlLmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWls
Q0EuY3JsMAsGA1UdDwQEAwIBBjApBgNVHREEIjAgpB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxh
YmVsMi0xMzgwDQYJKoZIhvcNAQEFBQADgYEASIzRUIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/
TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6EsZkbAMUaC4J0niVQlGLH2ydxVyWN3amc
OY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341YheILcIRk13iSx0x1G/11fZU8xggNkMIID
YAIBATB2MGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5
KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNzdWluZyBDQQIQ
AuvkETdTqf4dYKgtvKGiEzAJBgUrDgMCGgUAoIIBwzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcN
AQcBMBwGCSqGSIb3DQEJBTEPFw0wNzA4MDIxOTA5MDZaMCMGCSqGSIb3DQEJBDEWBBTw021Y
yNydiWEXp/eXTLm1zQUavDBSBgkqhkiG9w0BCQ8xRTBDMAoGCCqGSIb3DQMHMA4GCCqGSIb3
DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBhQYJKwYB
BAGCNxAEMXgwdjBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcg
KFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3Vpbmcg
Q0ECEALr5BE3U6n+HWCoLbyhohMwgYcGCyqGSIb3DQEJEAILMXigdjBiMQswCQYDVQQGEwJa
QTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhh
d3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECEALr5BE3U6n+HWCoLbyhohMwDQYJ
KoZIhvcNAQEBBQAEggEAoG24rhi6528uvRewm4vhm5haumNzvj88ftAf/FWqv5Eqcm2ao/cS
fFiXCAODdJRz9nuZSzp2/X0O9xx9Rmuqoh+B8MTKcL9nic8xnRfmLRVQg4TClFr7cV5UIV0i
9Jx4XwQhXjeyQ5VPKTsUeLmf7vuELBk0rlBsXeS/pBumKZ31tM7d3DaEKYFEGYZIXfBny9Kx
6iCiawRAkLYaIm7qzUxdbxBGaDjNWdAJE5WKhxHegSrTTfQetIx7IPV/CcmKHvhp945crKrx
0Yxe9jmz1icQJDZYNAtb8TXVUMNhxtHvBc4lpEfLqEMXt3PO+QT94rey+iWOSor9ePDd1L2m
xgAAAAAAAA==
--------------ms070401090806080400030004--
--===============1490525576==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============1490525576==--
