[19320] in Kerberos_V5_Development
Kerberos 1.14 - Java 1.6.0.24 incompatibility
daemon@ATHENA.MIT.EDU (Richard Basch)
Sat Dec 12 12:02:13 2015
Date: Sat, 12 Dec 2015 11:40:40 -0500
From: Richard Basch <basch@alum.mit.edu>
To: krbdev@mit.edu
Message-id: <A87AE9CE-37F4-4A82-888C-528082B74634@alum.mit.edu>
MIME-version: 1.0
Cc: Richard Basch <basch@alum.mit.edu>, Richard Basch <richard.basch@gs.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
There appears to be a protocol change in Kerberos 1.14 which causes older Java clients issues.
Assuming an environment supports weak encryption and is using des-cbc-crc keys, and a Java app is negotiating multiple encryption types, one scenario which can happen is:
- Java negotiates des-cbc-md5 and des-cbc-crc
- KDC responds with support for both
- Java actually makes request with type 3 (des-cbc-md5)
- KDC now responds with BAD_ENCRYPTION_TYPE if the principal is defined as type 1 (des-cbc-crc).
Previous behavior in 1.13 and prior: KDC would issue ticket (skey=3, tkt=1)
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
