[19956] in Kerberos_V5_Development
Re: Spurious tickets when using DNS realm configuration
daemon@ATHENA.MIT.EDU (Russ Allbery)
Wed Jul 24 12:48:02 2019
From: Russ Allbery <eagle@eyrie.org>
To: Greg Hudson <ghudson@mit.edu>
In-Reply-To: <15e967bb-bae0-11e2-2c38-1b7df8c2f25c@mit.edu> (Greg Hudson's
message of "Wed, 24 Jul 2019 12:28:12 -0400")
Date: Wed, 24 Jul 2019 09:47:32 -0700
Message-ID: <87ef2fmlaz.fsf@hope.eyrie.org>
MIME-Version: 1.0
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Greg Hudson <ghudson@mit.edu> writes:
> On 7/24/19 2:13 AM, David Cross wrote:
>> Additionally on the kdc i see that it additionally requests the tgt again.
> The TGT or the service ticket? Regardless, I don't have a good
> explanation for that; I wouldn't expect there to be multiple TGS
> requests in a simple referral scenario. Getting KRB5_TRACE output might
> help determine what's going on.
Maybe David is seeing multiple AS_REQs from pre-auth? That usually gets
logged as two requests, one without the challenge (which will result in
"Additional pre-authentication required") and one with it.
--
Russ Allbery (eagle@eyrie.org) <http://www.eyrie.org/~eagle/>
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
