[28530] in Kerberos
Re: Kerberos.app AD UPN & SAM authentication issue
daemon@ATHENA.MIT.EDU (Russ Allbery)
Thu Oct 4 23:03:49 2007
From: Russ Allbery <rra@stanford.edu>
To: "Michael B Allen" <ioplex@gmail.com>
In-Reply-To: <78c6bd860710041918w3c459f72w846b631c0b24c4ad@mail.gmail.com>
(Michael B. Allen's message of "Thu, 4 Oct 2007 22:18:08 -0400")
Date: Thu, 04 Oct 2007 20:02:39 -0700
Message-ID: <874ph62rhs.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
"Michael B Allen" <ioplex@gmail.com> writes:
> Active Directory does not use the userPrincipalName attribute to do
> Kerberos authentication. It uses sAMAccountName@dnsRoot.
I just tested against our Active Directory with an account that had both
userPrincipalName and sAMAccountName set to different values and was able
to authenticate using either of the two names via kinit from a Debian
system. Either returned valid tickets for the principal name that I used,
and both had the same password and hence were using the same Active
Directory record.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
