On Wed, 2008-10-08 at 09:31 -0700, John Dunning wrote: > Hello Andrew, > Thank you for your rewording suggestion. I have passed this information on > to my Product Team. > > I also have an answer to your question: > > "What is the kvno if the client does not provide one in that structure, when > it initially calls CreateTrustedDomainEx? (I think it is -1)?" > > Answer: > > If TRUST_AUTH_TYPE_VERSION is missing, the key version # for that > trust key in Kerberos protocol is not filled. In such a case, the > Windows Kerberos will ignore the missing key version # field. > The key version (and the TRUST_AUTH_TYPE_VERSION field) is always > present in Microsoft implementations to maximize interoperability.
I didn't find the version in the blob attached to the CreateTrustedDomainEx2 call I got from Windows 2008. That is why I asked. Perhaps I'm (as a server) meant to add this to the record? If so, what information should I use to do so? Also, while this element is indeed optional according to the ASN.1, it seemed to be filled in by windows in this case. I'll try to reproduce the setup we had at the IO lab this week, and give you some more concrete details. Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com
signature.asc
Description: This is a digitally signed message part
_______________________________________________ cifs-protocol mailing list [email protected] https://lists.samba.org/mailman/listinfo/cifs-protocol
