[28347] in Kerberos
RE: Problems with kadmind, kpasswd and cross-realm authentication
daemon@ATHENA.MIT.EDU (Anthony Brock)
Tue Sep 4 22:48:48 2007
From: "Anthony Brock" <brocka@sterlingcgi.com>
To: "Christopher D. Clausen" <cclausen@acm.org>
Date: Tue, 4 Sep 2007 19:48:21 -0700
Message-ID: <LEEIJGBJEEABAGOFFGAHCEKIDPAA.brocka@sterlingcgi.com>
MIME-Version: 1.0
In-Reply-To: <0F92FECD648148D59654343E489891FC@CDCHOME>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
> -----Original Message-----
> Anthony Brock <brocka@sterlingcgi.com> wrote:
> > I have created several cross-realm trusts on a test server. At this
> > point, nearly everything is working properly. However, users are
> > unable to change their passwords unless their account is in the
> > initial domain. Users see the following when attempting it from the
> > initial domain:
> >
> > # kpasswd
> > Password for brocka@SCGROUP.ORG:
> > Enter new password:
> > Enter it again:
> > Password changed.
> > #
> >
> > Unfortunately, following happens for additional domains:
> >
> > # kpasswd
> > Password for brocka@STERLINGCGI.COM:
> > Enter new password:
> > Enter it again:
> > Authentication error: Failed reading application request
> > #
>
> What happens if you run:
> kpasswd user@REALM
> and manually specify the realm name where the user account is at?
> so in your case, try running:
> kpasswd brocka@SCGROUP.ORG
> on the above machine where you were prompted for brocka@STERLINGCGI.COM
> credentials.
# kpasswd brocka@SCGROUP.ORG
Password for brocka@SCGROUP.ORG:
Enter new password:
Enter it again:
Password changed.
#
It works for the @SCGROUP.ORG domain (the initial realm). Here is the
results of the same with the @STERLINGCGI.COM realm:
# kpasswd brocka@STERLINGCGI.COM
Password for brocka@STERLINGCGI.COM:
Enter new password:
Enter it again:
Authentication error: Failed reading application request
#
> Additionally, are you behind a NAT when kpasswd fails?
No, the entire network is on a single, private IP address range. In fact,
I'm trying these particular commands on the same host that kadmind is
running on. However, the behavior is identical from a remote host.
Tony
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
