[28506] in Kerberos
cross realm and capaths question
daemon@ATHENA.MIT.EDU (Markus Moeller)
Sat Sep 29 10:24:04 2007
To: kerberos@mit.edu
From: "Markus Moeller" <huaraz@moeller.plus.com>
Date: Sat, 29 Sep 2007 14:30:26 +0100
Message-ID: <fdlmf4$ind$1@sea.gmane.org>
X-Complaints-To: usenet@sea.gmane.org
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
I have a setup with 4 DCs. 3 DC build a forest and the fourth hangs of one
of the sub domains.
TOP.COM
/ \
DOM1.TOP.COM DOM2.TOP.COM
/
TEST.HOME
There is full trust betweem TOP.COM and DOM1.TOP.COM and DOM2.TOP.COM.
TEST.HOME as only full trust to DOM1.TOP.COM.
I try to connect from a user in DOM2.TOP.COM to a system in TEST.HOME with
the following krb5.conf on DOM2.TOP.COM systems.
[domain_realm]
top.com = TOP.COM
.top.com = TOP.COM
dom1.top.com = DOM1.TOP.COM
.dom1.top.com = DOM1.TOP.COM
dom2.top.com = DOM2.TOP.COM
.dom2.top.com = DOM2.TOP.COM
test.home = TEST.HOME
.test.home = TEST.HOME
[capaths]
DOM2.TOP.COM = {
TEST.HOME = DOM1.TOP.COM
DOM1.TOP.COM = TOP.COM
TOP.COM = .
}
DOM1.TOP.COM = {
DOM2.TOP.COM = TOP.COM
TOP.COM = .
}
TEST.HOME = {
DOM2.TOP.COM = TOP.COM
TOP.COM = DOM1.TOP.COM
DOM1.TOP.COM = .
}
A walk tree test gives me:
#t_walk_rtree DOM1.TOP.COM TEST.HOME
krbtgt/DOM1.TOP.COM@DOM1.TOP.COM
krbtgt/TEST.HOME@DOM1.TOP.COM
#t_walk_rtree DOM2.TOP.COM TEST.HOME
krbtgt/DOM2.TOP.COM@DOM2.TOP.COM
krbtgt/DOM1.TOP.COM@DOM2.TOP.COM
krbtgt/DOM1.TOP.COM@DOM1.TOP.COM
krbtgt/TEST.HOME@DOM1.TOP.COM
But when I do a ldapsearch -H ldap://dc.test.home .... I get
additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous
failure (KDC reply did not match expectations)
An ethereal shows a TGS-REQ of krbtgt/TEST.HOME going to the DOM2.TOP.COM
instead to DOM1.TOP.COM.
What is wrong inmy configuration ?
Thank you
Markus
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
