krb5-API

2008-06-23 Thread naveen.bn
Hi Kevin, I found that the function krb5_get_in_tkt_with_skey which will acquire the pa-data for the PA_PK_AS_REQ is not invoked any were and, is it used . Can I find a good documentation on the kerberos-API for sending pre-authentication data . Thank you with regards naveen

Re: Principal attributes and policy in LDAP Realm

2008-06-23 Thread Simo Sorce
On Mon, 2008-06-16 at 19:25 -0400, Ken Raeburn wrote: On Jun 16, 2008, at 19:00, Klaus Heinrich Kiwi wrote: Is there a better description of what's in the tl_data structure? I saw some #defines in the kdb_ldap.h header file but couldn't correlate to anything just by looking at their

Re: Principal attributes and policy in LDAP Realm

2008-06-23 Thread Simo Sorce
On Mon, 2008-06-16 at 23:58 -0300, Klaus Heinrich Kiwi wrote: On Mon, 2008-06-16 at 19:25 -0400, Ken Raeburn wrote: The application data in question is indeed the MIT KDC implementation; all this stuff is internal to the MIT implementation. In src/include/kdb.h you'll find

Re: Principal attributes and policy in LDAP Realm

2008-06-23 Thread Ken Raeburn
On Jun 23, 2008, at 09:03, Simo Sorce wrote: Is there a specific reason why the database layer has not been abstracted appropriately ? Any chance we can work to fix these problems and come up with a better schema ? Mostly lack of resources/priority/motivation/etc I guess; certainly no

Re: Principal attributes and policy in LDAP Realm

2008-06-23 Thread Simo Sorce
On Mon, 2008-06-23 at 10:05 -0400, Ken Raeburn wrote: On Jun 23, 2008, at 09:03, Simo Sorce wrote: Is there a specific reason why the database layer has not been abstracted appropriately ? Any chance we can work to fix these problems and come up with a better schema ? Mostly lack of

Re: Kinit programatically??

2008-06-23 Thread Russ Allbery
kul gupta [EMAIL PROTECTED] writes: hello Thanks I m using MIT kerberose. I will appreciate if someone can help me how to proceed to ahieve the Kinit programatically. The user has entered -username and password through stdin. How can i get the TGT programatically?(using GSS-API) so as to

RE: Kinit programatically??

2008-06-23 Thread Paul Moore
U cannot get tgt with GSS Either System(kinit ) Or Call Krb5_get_in_tkt_passwd (I think that's the correct name) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of kul gupta Sent: Sunday, June 22, 2008 9:51 PM To: Tadoori (EXT), Vilas Cc: [EMAIL

NetIDMgr - showing incorrect lifetime

2008-06-23 Thread Rogier Krieger
Every now and then, I see incorrect lifetimes in the NetIDMgr window. Refreshing the view does not correct the displayed lifetimes (or only for the first identity in the list). The issue appears to be cosmetic only; even for 'expired' tickets (according to the timer in the GUI), there still

Still distributing KFW 2.6.5 to your users? Please don't.

2008-06-23 Thread Jeffrey Altman
Kerberos for Windows 2.6.5 was released on 17 September 2004. KFW 2.6.5 was the first release with an MSI installer, it included krb5_32.dll version 1.3.5, and was compatible with Windows XP Service Pack 2. As a result it was distributed far a wide but ... It is almost four years later. Vista

Re: NetIDMgr - showing incorrect lifetime

2008-06-23 Thread Jeffrey Altman
Rogier Krieger wrote: Every now and then, I see incorrect lifetimes in the NetIDMgr window. Refreshing the view does not correct the displayed lifetimes (or only for the first identity in the list). The issue appears to be cosmetic only; even for 'expired' tickets (according to the timer in the

Re: Kinit programatically??

2008-06-23 Thread Russ Allbery
You should really keep copying the mailing list so that other people can also help. I've re-added the mailing list as a cc. kul gupta [EMAIL PROTECTED] writes: Thanks a lot It helped me I read the link provided by u for Kstart But Can i use it for the authentication on the client side?

pre-authentication

2008-06-23 Thread naveen.bn
Hi Kevin, Guide on this , When i use require_preauth for the client and try to send the AS_REQ with pa-data using the command kinit -X X509_user_identity=FILE:/client/test.pem,/client/test.key naveen The first AS_REQ will go with out pa-data to the KDC, the kdc will replay with