[19678] in Kerberos_V5_Development
Re: Incompatibility between krb's AES256-CTS-HMAC-SHA1-96 and
daemon@ATHENA.MIT.EDU (Ido Shlomo)
Thu Nov 9 15:04:10 2017
MIME-Version: 1.0
In-Reply-To: <CAC-fF8QumBBaGsV_8mtK_M=oy=S9tLGdFW2CyONRfPUfKMC+KQ@mail.gmail.com>
From: Ido Shlomo <shloim@gmail.com>
Date: Thu, 9 Nov 2017 23:03:54 +0300
Message-ID: <CAK8_kVKY8H2o+yVRf7AFb0RPLRPk_eangj2JBCc+E05LpGX5YQ@mail.gmail.com>
To: Isaac Boukris <iboukris@gmail.com>
Cc: krbdev@mit.edu, Simo Sorce <simo@redhat.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
No. I am registering an SPN for a single account.
The operation has 2 phases:
Add an entry to the local keytab using ktuil.
Add an entry to the User object in the Active Directory using openldap.
On Nov 9, 2017 20:10, "Isaac Boukris" <iboukris@gmail.com> wrote:
>
>
> On Thu, Nov 9, 2017 at 5:00 PM, Ido Shlomo <shloim@gmail.com> wrote:
> > The thing is that kinit works well for the user (not computer)
> > The problem is that I register an SPN on the DC for that user (again, not
> > computer) using ldap, and then I resgister the same SPN
> > (MSSQL/mymachine.domain.com:1433@DOMAIN.COM). The problem occurs when an
> > incoming connection gives me a token that I cannot accept. The error is
> that
> > I cannot decrypt it.
>
> Wait, are you registering the same SPN twice to two different accounts?
> You aren't supposed to do that I think, as the KDC might encrypt the
> ticket with the key of the other principal.
>
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
