Hello all,
I am not able to get a ticket from a server 2008 or a server 2008 R2 KDC from a
Java, Solaris or Linux client unless I constrain the client to use RC4-HMAC for
the encryption types. (Have tried this using kfw-3-2-2 on Windows as well). Is
server2008+ not interoperable with these Kerberos implementations?
A brief background - if the domain is not in server 2008+ functionality mode
(ie there are 2003 or older domain controllers in the environment), server
2008+ does not enable support for AES encryption (unless the client is a vista+
client that has updated the msDS-SupportedEncryptionTypes attribute in its user
object). Server 2008+ also does not enable support for DES by default.
In the network traces, I can see clients proposing to use DES, RC4-HMAC and AES
for the AS-REQ if they are not configured to be limited to using RC4-HMAC. I am
expecting the client and the KDC to settle on the use of RC4-HMAC, however the
KDC replies with KRB5KDC_ERR_ETYPE_NOSUPP.
I don't want to constrain the clients to use just RC4-HMAC, as I want them to
switch to AES automatically when the domain functional level is upgraded and
AES support becomes available on the DC.
The Java version is the latest off Java.com. The linux and Solaris versions are
fairly current.
Wireshark traces attached. Any help you can provide or insights into why this
is not working out would be greatly appreciated.
Thanks,
-Ravi
THIS MESSAGE AND ANY ATTACHMENTS ARE CONFIDENTIAL, PROPRIETARY, AND MAY BE
PRIVILEGED. If this message was misdirected, BlackRock, Inc. and its
subsidiaries, ("BlackRock") does not waive any confidentiality or privilege.
If you are not the intended recipient, please notify us immediately and destroy
the message without disclosing its contents to anyone. Any distribution, use
or copying of this e-mail or the information it contains by other than an
intended recipient is unauthorized. The views and opinions expressed in this
e-mail message are the author's own and may not reflect the views and opinions
of BlackRock, unless the author is authorized by BlackRock to express such
views or opinions on its behalf. All email sent to or from this address is
subject to electronic storage and review by BlackRock. Although BlackRock
operates anti-virus programs, it does not accept responsibility for any damage
whatsoever caused by viruses being passed.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
