[19634] in Kerberos_V5_Development
Re: [kitten] Checking the transited list of a kerberos ticket in a
daemon@ATHENA.MIT.EDU (Simo Sorce)
Thu Aug 24 08:36:43 2017
Message-ID: <1503578184.3428.19.camel@redhat.com>
From: Simo Sorce <simo@redhat.com>
To: Greg Hudson <ghudson@mit.edu>, Stefan Metzmacher <metze@samba.org>,
heimdal-discuss@h5l.org, "krbdev@mit.edu Dev List" <krbdev@mit.edu>,
"kitten@ietf.org" <kitten@ietf.org>,
Samba Technical <samba-technical@lists.samba.org>
Date: Thu, 24 Aug 2017 08:36:24 -0400
In-Reply-To: <ec067a72-313e-1878-33a0-a3259d2979d5@mit.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Errors-To: krbdev-bounces@mit.edu
Content-Transfer-Encoding: 8bit
On Wed, 2017-08-23 at 20:38 -0400, Greg Hudson wrote:
> On 08/23/2017 07:01 PM, Stefan Metzmacher wrote:
> > > I think we should first consider whether it would be sufficient
> > > for MIT
> > > krb5 to suppress the rd_req transited check if the
> > > TRANSITED-POLICY-CHECKED flag is set in the ticket. MIT and
> > > Heimdal
> > > KDCs both appear to perform the transited check and set the flag
> > > by default.
> >
> > But Windows KDCs doesn't set this bit (I guess because it's just
> > not
> > useful).
>
> I don't agree at all that the bit isn't useful. That bit is how a
> KDC
> communicates that it vouches for the transited path. Unfortunately,
> you
> do appear to be correct about Windows KDCs. MS-KILE says:
>
> The TRANSITED-POLICY-CHECKED flag ([RFC4120] section 2.7): KILE
> MUST NOT check for transited domains on servers or a KDC.
> Application servers MUST ignore the TRANSITED-POLICYCHECKED flag.
>
> which basically means Microsoft has declined to conform to RFC 4120
> in
> this area, instead requiring servers to implement PACs to
> interoperate
> in a cross-realm environment.
>
> I guess the proposed credential option is necessary, in that case.
>
I think in this case ignoring the flag should probably be conditional
to whether a PAC is present.
My2c.
Simo.
--
Simo Sorce
Sr. Principal Software Engineer
Red Hat, Inc
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
