Maybe this helps (from
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/4a1daa3e-b45c-44ea-a0b6-fe8910f92f28.mspx
)
Markus
KRB_AS_REP Message Contents
The message includes:
. A TGS session key for the user to use with the TGS, encrypted with
the user key derived from the user's password.
. A TGT for the KDC in tailspintoys.com, encrypted with the TGS key.
The TGT includes:
. A TGS session key for the KDC to use with the user.
. Authorization data for the user.
The authorization data includes:
. The SID for the user's account.
. SIDs for security groups which the user is a member of in the
domain tailspintoys.com.
. SIDs for universal groups in the enterprise that include
either the user or one of the domain groups the user is a member of.
When the client receives the KDC's reply to its initial request, the client
uses its cached copy of the user key to decrypt its copy of the session key.
It can then discard the user key derived from the user's password, for it is
no longer needed. In all subsequent exchanges with the KDC, the client uses
the TGS session key. Like any other session key, this key is temporary,
valid only until the TGT expires or the user logs off. For that reason, the
TGS session key is often called a logon session key.
"NetSteady" <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]
> I'm actually speaking about the enc-part of the Kerberos packet itself,
> not in the ticket. Is this the part you were speaking of?
>
> Our problem is that we're trying to validate the password for the user
> when we receive the AS-REP packet, but for some reason, we cannot find
> where to get the encryption key for the enc-part. We've read the RFCs
> (many many times) and are still having issues finding this.
>
> Suggestions?
>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
begin 666 trsc_krb_117c.gif
M1TE&.#EA`@'F`/<``/D-$.\#">PG,-\&$]\3(.4S0,\)'-] 4-A-8+\,)M):
M<*\/+\QF@)[EMAIL PROTECTED]<5SD)\Y8'\93'\93;^ H&\<[EMAIL PROTECTED]']-
[EMAIL PROTECTED]:3\F<S\F<JNFT"\I?!\LAA\LA4]2::6SX \OCS],<A\_A2]&?+"_
MW\#,[EMAIL PROTECTED] _GP\YCQ],I2!,I2]9K#!9K#]FLD!F
MLD]RN%!SN5]_OV!_OW",QF^,Q7^9S("9S(^ETI"FTJ"SV9^RV*^_W[_,Y=#9
M[,_8Z_#S^>_R^ `YGQ-&I0`_I0\_CSELO]_K_^_U_P!F_P!&K ]O_Q]Y_R^"
M_S^,_T^5_U^?_V^H_W^R_X^\_Y_%_Y_ \*_/_[_8_\_B_Q]+AG^U__C[_Q],
MA;_;_P!Y_]_K^/+X_V^U_W^__YG,_Y_/_[C;_[_?_\7B_\SE_]+H_]CK_]_O
M_^7R_^OU_P""_Q^2_S^B_T^L_U^R_P",_P^/_P^2_R^?_S^E_S^H_R]9?&^\
M_Z_;_P"/_P"2_P^9_^CU_^_X_P"5_P"9_P^?_Q^E_R^L_S^R_T^X_U^\_U^_
M_V_%_X_2_Y_8_Y_/\*_?_[_E_\_K_]_R_W_,_S]E<S]F<J72X$^XL*O5T$]R
M:5^_H++8P'_,@%]_7[C<L&^,5K_?H)_88'^93,7BD*_?4,[EMAIL PROTECTED])FO2=+I
M<)^R.=CL8*^_+]_R(+_,)M_O4.7R0,_8'.SV,._R"?G\$-_E$___`/_SX/^9
M`.^2"?^?$-^,$_^E(,^%'/^L,/^R0/^Y4/^_8/_&</_,@/_2D/_9H/_?L/_F
MP/_LT/_Y\+]_)J]Y+Y]R.8]L0G]F3&]?5O\``/] 0/]04/^ @/^PL/___P``
M`/___P``````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M`````````````````````"'Y! $``-T`+ `````"`>8```C_`+<)'$BPH,&#
M"!,J7,BPH<.'$"-*G$BQHL6+&#-JW,BQH\>/($.*'$FRI,F3*%.J7,FRY38<
M+&+*G$FSILV;.'/JW,FSI\^?0(,*'4HTJ(Z#+-8H7<JTJ=.G4*-*G4JUJM6K
M6+-JW<JUJU862+V*'4NVK-FS:-->!6LP*50/#QA4&*&VKMV[>//>95O0;5,%
M`*P)[EMAIL PROTECTED]@@M[#B!,K/LR7H%^E71@,'I# P&##BS-KWLQY:N.!C]=HZ/+ `0F9
M)"Q;P]RYM>O7>#\+##T"P8"8-&S88)%:L ?8P(,[EMAIL PROTECTED]@)0."IPR(O>
M!89+GTZ=:?''&I)_8.%CVPJ!1UZ$_Q!<H;KY\ZZO,[EMAIL PROTECTED](+&T<0;3MR!I,/
[EMAIL PROTECTED]'4#/OW]B]4L58$T'8*%1QQMR;'-)$2Q\$( U'!0EX8045FCAA1CRY(14
M`"HE((';6#*&&VO (1 [EMAIL PROTECTED]:*M.CBBS#&*..,--9HXXTXYJCCCCSVZ../
M,H;65(=K? B6(H]D4D<<H*G((I!01BGEE%16:>6/0EH75H #'MFB)@)M89R3
M5Y9IYIEHIFEEEDL1:>[EMAIL PROTECTED]>2:;2KG9)9PNRDFG!!D6:NBA
MB";ZDQ0P\KF&GQNPL,(ECK0H:(K69./2IIQV6A$+C7*XI5((6+,`"R_XD 2E
M`DU!IZ:>QO\JZZR.A1H5D14(MD (J*HZ$(,-9$KKL,[EMAIL PROTECTED],`
MKR_H)@,[EMAIL PROTECTED];'89EO2L2XF.^I2M0WV;$P=)" 8-MJFJVY'W+;H;5M0A3O8
M8-=<N^Z]^%+4KB+O]B45"! 0,!@&^19LL$/[]NL8AXU>% 0*!T<<:\*BPGMK
MPQ7=$-,,0DCL<4L4W_JM4PE7I (+./[EMAIL PROTECTED]<?^SR22%#I>R0&[EMAIL
PROTECTED];).$
MRBQ#_/+/(,7\U,S6U2S1S7SMO/(-*0#M]$9"DSPRS<A6A'1!2>@0$]-/=_VI
MK3)/7735%%UMT I:LW"#$5ZW_5#40XK=IM$1F7T0VBS H(+;?"O_!+>6%LM,
M-T17<V'%%P<=P<(/?3?>%MA#R]WGX ]=#8464QS>%N..=VX<Y%('/C3E#ME]
M^118/.$8YYXW_G>;DC]*>D.60R'0$UA$D?ILK#_$#4*_?\1-\" 1#_3K?<9>
M<MDQ;</[EMAIL PROTECTED]"NT/#8#W_]0L83A#WPQ?.-_*/*S\Z0V5]8`;WJJS?4
M/?C;PW_0^QK1?SSH<8M.LOD+V;W-%U?0'?N,T[N$&(]XW]L&[EMAIL PROTECTED]>S-CX$)
M=* "M<? "[EMAIL PROTECTED] ,[EMAIL
PROTECTED]'@D$)XFM\1)L;V6S6/"]$[W:YJQX!W>>]"[EMAIL PROTECTED]
MH SAM\ 9VE"#,(SA^W([EMAIL PROTECTED](_X_6O">H[X338]_B6,C!&[EMAIL PROTECTED]
M81-O.,4?6C&"5<RB$]451/U1K5M6:YY TH>Z`:Z0(0?<8@<+8K\>:I&*<(2C
M#]_([EMAIL PROTECTED];&@8 A=[L[(_=:2,4<+K"-==0A':?H1A?.T9&,7!<>
M%Z9',#*O.-2S'AH):4%%=A*"!FG@&S\9QRM2<((W/.4/)8D_P.51<'N," Q2
ME02_%;!U;9LD:[EMAIL PROTECTED]@880:HZL%WD')+7'9-E[/AI24M(@[EMAIL PROTECTED]
'PVR?,<77
M2MAY<[EMAIL PROTECTED])-:4XSE]5,WC5%F$V,"$%C*"N")K_I-60:[EMAIL PROTECTED]&F#
M'K"@8^QL9SC)-__.R?4R(_.,"0R0D$]](JMBKQS=/S5BA!3LK:#'W&<(_5E.
MB%JT(>Y,%O\NRE'02%2(%>VH2&MU4)'U4W8+'6E',PI/?JGTI23M%D(I"<N0
MPI2C+*UD/#&"#&#XXJ>^(,8Q;NJRG-9TIQ5YAC& RE1?&*,71)68415J4X<X
MPZ>^F(8(8E(":OSBI\N(ZL&FNK^4+N09PO!%,$Z &QNLS 3#^&DR.&(_.Z;$
MKB+!JT?(^D6D2B09:HT!"WI0R^:P( ;1^"DR)I([EMAIL PROTECTED];)8HNO
MV/1K1(CABPNP8 @$><,<BK"R"_S4&171JUWMF$:)4!:R-LP69LFI68C__#0&
M,LC$(EK4"$S$H0TKH $+H.'49U"DM9_TH?8\R,D64C""T%TN%%5IV;H^%Y6'
MG*YVV?71DRYO(C]]SR4B<0E-M&@2=("#XDKP4V [EMAIL PROTECTED]:6UV&RE#1,Z/?K][
M9"GCZ+WN'=**],UO)#,R6XK6]B'AM<$E+N&%;42B19EPPQAV<[EMAIL PROTECTED]<94/4=
M(?V;2E%N%X'2[6^(`\Q(`6^QO],=\1/IF\%3:J3 [EMAIL PROTECTED](:-$E
MT$"'(^R&!14&ZC$RO,E1DI+#\ENQ(O4+X%4^%LE--"0;0P+C[TJD&+[8:A$F
M(9\<*V(;F-@&&[EMAIL PROTECTED]@_'7*1(;GB1++6_[F<-#&)[EMAIL PROTECTED](MT,D:J
MO-&$*,,7T'@/(AH1)T5$(A-C&'.9N8IF7QP#M0:,\W4=2=W(3CK%I92S<EV,
MZ0_C68?4?>W;NIO0LLKXK#XM`7<PL5L=*P(3FI $HM'@G;25`,W @*_C1'U9
[EMAIL PROTECTED]"&!_([EMAIL
PROTECTED]((1+J($(C*!B%AC(M%CP!L+1/#5Q?;-LF/U]2YUZE*+
M8!D:@[EMAIL PROTECTED]>`A/-?L0EH+T"F([EMAIL PROTECTED]&*5%9_-RI!G<'[EMAIL
PROTECTED]@@Y71
MH B(D,0E$$$)\H[!=L(EKC'"%^^(S/O4#7%&6G\Q#;;&) :>774C)$&);5!"
[EMAIL PROTECTED],\-/[<IHDR/]=J;:3R>WB2.09R `J-&;^U;6R0)U)D 0C.HZ(+SQ!
M:\2%="1Y?1$]7_3AP9Z(,YB15J!.7+ LH,$V$#'HCH,!)L1MQI1-OMWD?AC;
M/#QRG5VW\G>VW"/.:(;:T:I6$:B:!C0P=IAA<H*OZAJ*6Z]OWMFL]Q/+>;]$
M?QG2NQV2JP)5U;WJ][2_JHS(ICB_!Y1OE.OLV,9.WIB#=SE'FG$,+/\T&#-Y
M-S#".LC8XOWT=_:[)Z<<^**67:/[EMAIL PROTECTED],FH,UR8D<L)25O,-%CMUQF4_)
M,SP/U(5;.O(X!+$I5S_T#.Z]=<%72=K7[K'6N[ZD8?-NGU]J_>O+U*2E[BO_
MX1MNT>B3O_RO;ZGFSX]+\[,_G^Y__S?C+W_,I__L]6<G_?/ON<$S05$`&( "
M.( 5<G]'I2<(F( *N( XHC#;=H ,&($2.(%VXH L!X$4F($:N($^8H%FAX$<
M&((B.(+N,E,/.#0$F((JN((LN!,N8((7Z!\R.(.M,5$T>(,X:!<VF(,\V(-B
ML8,^&(1"6!5 .(1&>(36%'Y+\0FJP JET E(&(4^2#2OH N\<(57J NG((5<
M2(/[EMAIL PROTECTED]@(6[0 NW@(5;V(5HB![*(@J5H JNT 0RT01ER MGF([EMAIL PROTECTED]
ML MMM1MR>(6?<(>"&!S*@@N\D NFP!S;X!Q_: N#__B(Z?$MHG"(@< [EMAIL PROTECTED]>
M+T &[EMAIL PROTECTED])FD$DK\ +J? >\3$?]7$?LL +M>")K/@?WV(+O, )8#$'=( @
M"L(@@9 +O+ )+=B+OOB+%K(AX/=KL"B+VY )=- &)7(B+) *O# *)!B-TJB
M'[EMAIL PROTECTED]@6BZ )F8 &"3(&QN&,T#B-XCB.:%*-3'&-@&)H`L$%W_B,Y/[EMAIL
PROTECTED]
[EMAIL PROTECTED]@GVS GS>B.\;B/[EMAIL PROTECTED]@[EMAIL PROTECTED];B [EMAIL
PROTECTED]"0DE"VDI_?A]
MV9=0L @*DD(IEC*0^5B0:G(0-=*0A=:1`_$C'JDC'$DC(QDHTOB/:Q +O" +
MO;(JCM J!(F )XF2'7F3-O_)(S5)[EMAIL PROTECTED]"E<H"V3PDK_"`K"@CWER
MD.D8DE]FDR%)$#+2D' B$!<)*%+Y95$ID%9YE1[)E%SID&[EMAIL PROTECTED]@
MA;P`"T49+38P+:1PA9Y DQ_9E$]YEW8YDE1)E7>)ESF9ESF)D'6)[EMAIL PROTECTED]
MC6>Y!GJ(A6P9$YQ "U>X"@D(EGWID$TIE4S9E9=9E0BYE6/YEX09F!_YF86V
[EMAIL PROTECTED](A:TPEY,YF/9HEZ,9(PG)F:!)F[39E[A9F;59F+,IFKX9
[EMAIL PROTECTED])%&& "K. A:' @)0)F(?YE"<)EI0)G5 )FI8IG(;YG+@)G,[EMAIL
PROTECTED])6PHY
MFF3_"95=J94F.9ZSV9N7R9OD69Z"^9>G.9;NZ9X<^)T&]I D^)/X:2/V&6/[
MR8%.^9] TI_[(J &^I\$>J **J )NJ .VH\-^J 2^HX1VB+_!XP8FJ$:>A-*
M8(# -G[\!WT>:FI)%Z+4A'V1HWVQ9Z)/LW\L>J(0F:)*")[K]Z(1A:*A,Z/W
M6:,VZC0N&A'+8 S%,*3%@ RDUZ.S\J,/H0Q8U52-AZ3R-J+BQZ,*,7P_-0S3
M4 )=A6;"('10NBE*RA">5PTU06V^``Q:MQ%U%2O=5W0J$:8*L0R^\ ML10-$
M4$M'H#4G8&&^<*23U5AO!ELFUWIMVF*LA*/YHZ/^":(0_X%EU/!,! $':' ?
M,2 -9WIW\<5$D;:I)Z:IJ=5<O8:HKO1K),JH".8+)O "B/ (CN (DG (;A '
M1+ R%F9MC"5IN== 8/= S]6KOJII'51=P'-=(P:LRK=74II9INH0"48IFE I
MC' )<# '1 !D/U4,:9JI><9W?_=\H(1G3%9B_'5ZXJI*ES=?IK=GR4JC%=&L
[EMAIL PROTECTED]&VU IBX (;; -TV*IU\H,VLIWO!=%SM=AIN>ON5=(OX=*+=:M)A9V%G1R
M%P&G"1%>,H (E[ %4( )7T('U/I6^.H+PN"GI<>O8@>JH/IWZ#JP)5MZ4-9F
M:D1EZ[JC%<%9JK8"DS ]<*()7/[EMAIL PROTECTED]>W1&8H&J9 3+K>5*
M>1MV>7$6M.G:L"V[J%2*$#$G#<^4":U*:)J@"3LG9FB0LS'@53_5L9BZ=\<J
M1Y4VK)=FJ%>T7PL[J"*F>J!6MASAL C1"S]E`BQ !);@(EFK" 77<6C0M4,P
M+5_;L\30.H7J*72+$,?@"\. *D= "2]R:!(;"1V7:(M(N-/P4T_*-]AF,(M[
M$&PW#:A2!)F0M9.0!"[EMAIL PROTECTED]")J "(&;N2Q #9?ZI2PKJDE(JE-Z$89'M<]$
M!$4P!,)%6)C 99<@":]+:TE JX[&<$@:[EMAIL PROTECTED]"+*6"9(P
M"4_P!4/_P +L!0QNBQ(IAU-/:V45X0R<-:?4\+[$)0TQ\ *K&Z^'QFQ<``6[
M$5=$YD2)JV&=BGZX*TZ*JKX6H0PQUU2.BS,VH .(8 F6<&C_8T]9YZW_>F27
M%EWXY;_F&L P6H+#>(*E&K4/T0O*D PH;'C1`'4]T .1.[,H$@,6UK_?>K0C
MR[2]AUSH*J(#S$\%O'T5(:= A;<X$[PP`5=.Y7@':[ U++24YV*61[3]E[Y
M7!'*T'3!``V^>W%?-50H>U\HYL1P:W3=VCG0:Q&-^U/3\+Z)Y0MS]5A&JWM&
MJV?A6K!]<\86L71-VEYCVVG_&JS+-ZYV=L$>?,=4O*(<\0PG_XS"^BHQ_PNZ
MAPQQ,/7(D-S#-FC MNNCD5RBF?PQ>-S)AQJC.:J[RDK"H)POGWS*VI+*JARJ
MHIRHI,[EMAIL PROTECTED])RUH11O #OOS+P!S,/Q $38/+4*/+IKP0*E #
M0L$#!&7,ZEK+*BK)#6$$, "I"@&O! $$+P`#/@/-7R/-/XS("B$$U^P#B-!J
M,@(F:5 (+1*M*[ ;-_!0X"P1K"P0/Q 3QD9H-=((F? %=^ BDH (W*PW]6S/
MR'P1^8R]K(8CBS )4& '+A*MU5I,!^TW"6T1P%0$EJ#.,I*-FD!HC/ $>9"U
MR!8)X1L$%PT1]]P\-N+/`C%HCO %<[EMAIL PROTECTED]"?=1S"N-41G]*5Y"(V$V$,LF
M!LCFMYB0";OQS#O-$"W]TS+2<04!!7S@(HN0">&;S!?=U![)"&!B$(,`(X@@
M7/BTU$S=T_KBU(K ".25$)#P(HZP`BS `^I"J$F6R^(<RRYK$2Y-U?*A$'_P
M(IK (#L`6XG+7)[ZL8+Z068]$7O=(I; $&! "!.-"#"ATY]6R YQOHB]V76M
MV'<MPKNKUTX-U0NA!B_R",L[4$![P5C$:1N\7% ,R(;:[EMAIL PROTECTED];VURTV/;LU)'@
M$(#P([EMAIL PROTECTED] 'QV%<QR<[R*R'V<1RSS/P`DGP""_RV N!"'@@T(A0K8--
[EMAIL PROTECTED];!+WG,\X,&@3O1"1D AQLAL&K=W%;<%-2\=&
M)MZIU\2KC-L2H3$]H%LM0MH(89LL4 /??-D!R[0(KFF^=]R2)\7E/1+WO U(
MP,S&I@@QN1 $;MGE2TI>=WP<C'QEN[;CG7R>_<JC"MJEG!'6S )'@&X+`08O
M\M HPN%DG1 [EMAIL PROTECTED]"H,P0:&< D#D00_IM0WCM&?'8,CC!$G\P+[IA;A%(<,U)8 5S
MDA!>H =Q0EHU0.1ECA#W' 3/] 11$ [EMAIL PROTECTED]"A0$+XY<.<+],'<+IX[
M?<Z.!Y$%6? $?6!H3T %3V!/%HWHGW/FL$?-"($"[P$%4]#G?7X%VCP06]#H
M92 (3U %45 %^LL"!Z[I'L7IZJ?E*",1I\Z,F7[GK"P$%S+KM+[I5D[ > VU
M%]'+PKSLS [,PC[L.3[L0</?TMXIT5[MW&7KW*8$&]KMWHZANCRAXDZ"%3KN
MYDZ<J=GIY[[N&ECN[/[N#.CN\#[O>M*?2_#M^)[O&MH"Z=Z*_HZ'L?/O`K\8
M13CP!A\;`7_P"J^#";_P#G\6!?_P$N\5$3_Q%I\5%7_Q&D\5UZ'O'O_Q("\3
0-8;M)%_R)G_R*#\K`0$`.P``
`
end
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
