* Andrew Deason [2013-07-25 14:35:58 -0500]: > On Thu, 25 Jul 2013 15:22:50 -0400 (EDT) > Benjamin Kaduk <ka...@mit.edu> wrote: > > > On Thu, 25 Jul 2013, Sergio Gelato wrote: > > > > > I've been poking a bit into this. First of all, let's make sure I > > > don't misunderstand your expectation here: do you want the KDC to be > > > willing to issue a ticket with a des-cbc-crc session key (as > > > requested by old aklog) even though the afs service principal does > > > not have that enctype? > > That was the idea. But that doesn't work, as you've seen. Sorry about > that; we were trying a lot of different KDC/configuration > combinations... > > > > Or are we Heimdal users expected to add that enctype to afs/cell > > > whenever we rekey? > > That appears to be what you'll need to do, unless you can change the > KDC's behavior.
I've now succeeeded in changing the KDC's behavior. First of all, Heimdal's krb5.conf(5) man page states the wrong defaults (I've reported this bug). [kdc]svc-use-strongest-session-key is false by default, toggle it if you want to use the new session key selection algorithm. Secondly, the following patch is required: --- a/kdc/kerberos5.c +++ b/kdc/kerberos5.c @@ -183,9 +183,10 @@ } } if (clientbest != (krb5_enctype)ETYPE_NULL && - enctype == (krb5_enctype)ETYPE_NULL) + enctype == (krb5_enctype)ETYPE_NULL) { enctype = clientbest; - else if (enctype == (krb5_enctype)ETYPE_NULL) + ret = 0; + } else if (enctype == (krb5_enctype)ETYPE_NULL) ret = KRB5KDC_ERR_ETYPE_NOSUPP; if (ret == 0 && ret_enctype != NULL) *ret_enctype = enctype; I'll submit it to heimdal-bugs for consideration. > If you're expecting to be rekeying the AFS princ regularly or > frequently, though... doing that is still usually a disruptive > operation, even without this changing-enctype stuff for transitioning to > rxkad-k5/rxkad-kdf. That won't change until the Kerberos tools improve. Speaking of which, is anyone known to be working on rxkad-kdf support for Heimdal's libkafs? I'd like kinit --afslog to do the right thing. > > If the KDC is in a state where it must choose a session key enctype in > > the intersection of the service principal's keys and the client's > > list, then the latter should always work. The DES key for the > > afs/cell principal will need to be entered into the KeyFile or removed > > from the rxkad.keytab in order for server-to-server authentication to > > work, though. > > Or just run add_enctype after you extract the keytab. That seems like > the easiest way to account for this in the instructions. While I recall > it being mentioned that add_enctype may be a relatively new feature, > having different enctypes for the service ticket and the session key at > all also appears "new", so maybe that is moot. I've glanced at #10110 in Gerrit, will see if I have any constructive comments for you. I'd guess that early adopters of rxkad-k5 are likely to be running a sufficiently recent version of Heimdal (one with DES disabled by default). _______________________________________________ OpenAFS-info mailing list OpenAFS-info@openafs.org https://lists.openafs.org/mailman/listinfo/openafs-info