[19508] in Kerberos_V5_Development
S4U2self and one-way trusts
daemon@ATHENA.MIT.EDU (Singh, Sundeep)
Mon Nov 14 21:39:35 2016
From: "Singh, Sundeep" <Sundeep.Singh@netapp.com>
To: "krbdev@mit.edu" <krbdev@mit.edu>
Date: Tue, 15 Nov 2016 00:05:43 +0000
Message-ID: <d8091c46851d4471a90434a8ccef7470@hioexcmbx08-prd.hq.netapp.com>
Content-Language: en-US
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Hi,
I am trying to test S4U2self with one-way trusts between Windows domains and seem to be running into an issue.
I have a test setup where DOMAINA trusts DOMAINB. Server1 exists in DOMAINA, and user1 exists in DOMAINB. Given the direction of the trust, it should be possible to get a service ticket for Server1 for user1.
>From the TRACE calls in the Kerberos library when S4U2self functionality is triggered on Server1 for user1, Server1 attempts to get a TGT to DOMAINB by using the principal "krbtgt\DOMAINB@DOMAINA". This request is sent to the KDC for DOMAINA. My understanding is that this krbtgt account will not exist for this one-way trust, and the request fails with "server not found in Kerberos database" in my setup.
So, is S4U2self expected to work in a one-way trust scenario? If so, what should be the principal for the TGS request to get the TGT to the user's realm?
Regards,
Sundeep
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
