[38800] in Kerberos
RE: Kerberos Database Sync with Sub-Domains
daemon@ATHENA.MIT.EDU (Jonathan Towles)
Tue Jul 14 09:58:23 2020
From: Jonathan Towles <jjtowles@synterex.com>
To: Isaac Boukris <iboukris@gmail.com>
Date: Tue, 14 Jul 2020 13:55:52 +0000
Message-ID: <MN2PR15MB30719AB616C2C738E5E8FDBAB9610@MN2PR15MB3071.namprd15.prod.outlook.com>
In-Reply-To: <CAC-fF8Qi=a+_dfoJ6uDmvXGef18+z27uwQAPic74tsyfN9VrRA@mail.gmail.com>
Content-Language: en-US
MIME-Version: 1.0
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
I got it to work if I reference the UPN in the command.
The application is doing AS-Requests.
I'm guessing that they need to change the code as that needs to be applied in the GSS Kerberos H file right?
Jon Towles
CTO, Synterex
(m) 978-609-5545
-----Original Message-----
From: Isaac Boukris <iboukris@gmail.com>
Sent: Tuesday, July 14, 2020 9:54 AM
To: Jonathan Towles <jjtowles@synterex.com>
Cc: Bryan Mesich <bryan.mesich@digikey.com>; kerberos@mit.edu
Subject: Re: Kerberos Database Sync with Sub-Domains
On Tue, Jul 14, 2020 at 3:37 PM Jonathan Towles <jjtowles@synterex.com> wrote:
>
> I'm working with an application inside of a Docker container that uses GSS to do Kerberos Constrained Delegation.
Constrained Delegation (S4U2Proxy) is a way to get a service ticket, but the client name is determined in a preceding step of getting an initial ticket, which can be done in two ways (only), kinit (AS
request) or protocol-transition (S4U2Self), and they both support the use of enterprise names (using client-referrals).
> I'm guessing they need to augment the code.
Could be, in recent krb5 libs you can make use of GSS_KRB5_NT_ENTERPRISE_NAME in gssapi.
> Doing some testing via kinit, I have found that kinit -E only works if the account lives in the parent domain.
>
> If I try to do a kinit -E with their samaccountname or email address, it says they're not found if they are in a child domain.
It should generally work with the UPNs (or samaccountname@realm).
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
