[28319] in Kerberos
Windows Server Referral Problem
daemon@ATHENA.MIT.EDU (Markus Moeller)
Fri Aug 31 19:52:09 2007
To: kerberos@mit.edu
From: "Markus Moeller" <huaraz@moeller.plus.com>
Date: Sat, 1 Sep 2007 00:51:20 +0100
Message-ID: <fba9hu$hi8$1@sea.gmane.org>
X-Complaints-To: usenet@sea.gmane.org
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
I have a problem with server referrals in my Windows environment. I have
two Unix webservers server1.example.com and server2.example.com with SPNs
HTTP/server1.example.com and HTTP/server2.example.com respectively. Both
SPNs are setup under a Windows 2003 SP2 domain test.example.com.
test.example.com has a two way trust to example.com (2003 SP2 domain) which
has a two way trust to prod.example.com (2003 SP2 domain).
EXAMPLE.COM
/ \
/ \
TEST.EXAMPLE.COM PROD.EXAMPLE.COM
The problem I have that a user from prod.example.com can access server1 and
authenticate, but can not authanticate to server2. The reason is that the
client gets an error "unknown principal" from prod.example.com when
requesting a TGS for HTTP/server2.example.com whereas for
HTTP/server1.example.com the client gets a TGS referrals reply to
example.com and from there to test.example.com.
What determines on the domain controller prod.example.com to reply with a
referral to a TGS Req ?
BTW I only assume the replys are referrals as the TGS Req does not have the
canonicalisation option set and the TGS Rep doesn't have pa-data as
described in draft-ietf-krb-wg-kerberos-referrals-09.txt. Does Windows
follow that draft ?
Thank you
Markus
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
