[19306] in Kerberos_V5_Development
X.509 preauth
daemon@ATHENA.MIT.EDU (Pascal Jakobi)
Fri Oct 30 18:15:09 2015
To: krbdev@mit.edu
From: Pascal Jakobi <pascal.jakobi@gmail.com>
Message-ID: <5633EBE0.6070103@gmail.com>
Date: Fri, 30 Oct 2015 23:14:56 +0100
MIME-Version: 1.0
In-Reply-To: <5633EA90.4040308@gmail.com>
Content-Type: multipart/mixed; boundary="------------060502090604010907020006"
Errors-To: krbdev-bounces@mit.edu
This is a multi-part message in MIME format.
--------------060502090604010907020006
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Hi there
I am trying to run pkinit/X.509 with the standard MIT rpms delivered on
CentOS/Fedora/RHEL.
I have created the certificates with OpenSSL, everything looks fine - I
have a client cert such as/C=FR/L=Gennevilliers/O=Thales/CN=Toto, and
the corresponding KDC cert and CA cert have been checked.
I also modified the principal with kadmin : "modprinc +requires_preauth
toto".
I run kinit for the "toto" principal with KRB5_TRACE set. I can see that
the KDC sends the following to the client :
[6832] 1446241709.215007: Processing preauth types: 136, 19, 2, 133
PA-PK-AS-REQ (16), which I understand is for X.509 certificate
preauthentication, is not in the list.
I guess something is therefore wrong on my KDC configuration, but I
cannot see what.
Can someone enlight me ?
Thanks in advance
--
Pascal Jakobi <mailto:pascal.jakobi@gmail.com>
116 rue de Stalingrad, 93100 Montreuil
France
Tel : +33 6 87 47 58 19
--------------060502090604010907020006
Content-Type: text/plain; charset=UTF-8;
name="krb5.conf"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="krb5.conf"
W2xvZ2dpbmddCiBkZWZhdWx0ID0gRklMRTovdmFyL2xvZy9rZXJiZXJvcy9rcmI1bGlicy5s
b2cKIGtkYyA9IEZJTEU6L3Zhci9sb2cva2VyYmVyb3Mva3JiNWtkYy5sb2cKIGtkYyA9IFNZ
U0xPRzpERUJVRzpMT0NBTDEKIGFkbWluX3NlcnZlciA9IEZJTEU6L3Zhci9sb2cva2VyYmVy
b3Mva2FkbWluZC5sb2cKCltsaWJkZWZhdWx0c10KIGRuc19sb29rdXBfcmVhbG0gPSBmYWxz
ZQogdGlja2V0X2xpZmV0aW1lID0gMjRoCiByZW5ld19saWZldGltZSA9IDdkCiBmb3J3YXJk
YWJsZSA9IHRydWUKIHJkbnMgPSBmYWxzZQogZGVmYXVsdF9yZWFsbSA9IFRIQUxFUy5DT00K
IGRlZmF1bHRfY2NhY2hlX25hbWUgPSBLRVlSSU5HOnBlcnNpc3RlbnQ6JXt1aWR9CgpbcmVh
bG1zXQpUSEFMRVMuQ09NID0gewogIGtkYyA9IGtkYy5qYWtvYmkuZnIKICBhZG1pbl9zZXJ2
ZXIgPSBrZGMuamFrb2JpLmZyCiAgcGtpbml0X2FuY2hvcnMgPSBGSUxFOi92YXIva2VyYmVy
b3Mva3JiNWtkYy9jYWNlcnQucGVtCiAgcGtpbml0X2lkZW50aXRpZXMgPSBGSUxFOi92YXIv
a2VyYmVyb3Mva3JiNWtkYy9rZGNjZXJ0LnBlbSwgL3Zhci9rZXJiZXJvcy9rcmI1a2RjL2tk
Y2tleS5wZW0KIH0KCltkb21haW5fcmVhbG1dCiAuamFrb2JpLmZyID0gVEhBTEVTLkNPTQog
amFrb2JpLmZyID0gVEhBTEVTLkNPTQo=
--------------060502090604010907020006
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
--------------060502090604010907020006--
