The NT client doesn't use fakeka for it's authentication. It uses
udp/750 (standard K4). Because of that, the first enctype that is stored
in the KDC for a user is the one that will be used (I think). What we
did was make sure the our kdc.conf listed the 'des-cbc-crc:afs3' enctype
first. This seemed to satisfy the NT clients. UMICH has made some
modifications to the K4 libraries to make them act more like a kaServer,
but since we have no K4 salted keys (only afs3 style) besides the K5
keys in the KDC, we just ordered them with afs3 at the top.
Question: Does anyone see that as being a problem? So far everything
seems fine in our testing. Since K5 allows for the client to specify
which enctype it supports, the issue seemed to only affect K4 style
authentications...
-- kevin
/-------------------------------------------------------------------\
| Kevin Rowland Phone: (219)631-4745 |
| Sr. Systems Engineer Email: [EMAIL PROTECTED] |
| Office of Information Technology G208 Hesburgh Library |
| University of Notre Dame Notre Dame, IN 46556 |
\-------------------------------------------------------------------/
Elmar Abeln wrote:
>
> Has anyone successfully used the Windows AFS client in an AFS cell with Ken
> Hornstein's NRL AFS-Kerberos5 migration kit (which allow you to run a
> normal Krb5 server, storing afs3, krb5, and krb4 keys)? We've successfully
> used it with unix clients (using aklog to obtain AFS tokens from krb5
> tickets) and have preserved the ability for users from foreign cells to
> authenticate to our servers by running "fakeka", which decodes just enough
> of the RX packet to forward the authentication request to the krb5 server.
> So far so good... but the Windows AFS client has looked more attractive to
> us lately and we cannot get it to work with our modified setup...
>
> I can browse AFS filespace unauthenticated just fine. I can
> successfully obtain tokens for an unmodified AFS.
>
> But authenticating to the KDC Server i got at first the error
> The AFS Client was unable to obtain tokens as x30 in cell urz.uni-heidelberg.de
> Error: 37 (unknown authentication error 37).
>
> This was an result of bad skewed times on Win and Kdc-Server (sol 7)
> But after correctin this problem i got an expired token (!) with
> expiration time 11:41:00 12/12/17 (!!!).
> Has anyone an idea ?
>
> Thank for help.
>
> Elmar
>
> ------------------------------------------------------------------------
> Dr. Elmar Abeln email: [EMAIL PROTECTED]
> Universitaetsrechenzentrum
> Im Neuenheimer Feld 293 phone: +49 (6221) 54 4513
> D 69120 Heidelberg fax: +49 (6221) 54 5581
> ---------------------------------------------------------------------------
