This is the minimum code to keep Active Directory from putting Failure Audit
stuff in the event long:
krb5_preauthtype preauth[] = { KRB5_PADATA_ENC_TIMESTAMP };
krb5_enctype etypes[] = {ENCTYPE_DES_CBC_MD5};
memset( outOptions, 0, sizeof(*outOptions) );
krb5_get_init_creds_opt_init(outOptions);
krb5_get_init_creds_opt_set_address_list(outOptions, NULL);
krb5_get_init_creds_opt_set_etype_list( outOptions, etypes,
sizeof(etypes)/sizeof(krb5_enctype) );
krb5_get_init_creds_opt_set_preauth_list(outOptions, preauth,
sizeof(preauth)/sizeof(krb5_preauthtype) );
in article [EMAIL PROTECTED], swbell at [EMAIL PROTECTED]
wrote on 2/3/03 9:50 AM:
> I assume the API that allows this is
> krb5_get_init_creds_password,
> And the associated krb5_get_init_creds_opt_set_preauth_list.
>
> Where is there documentation on putting stuff in the preauth list?
>
> My Active Directory domain controller (Windows 2003) wants three preauth
> types (debug output below):
>
> salt len=-1; preauth data types: 11 2 15
> etype info 0: etype 3 salt len=17 'KERYGMA.ORGnelson>\xef\xbf\xbd9'
> etype info 1: etype 1 salt len=17 'KERYGMA.ORGnelson'
>
> It looks like you could always guess that the salt is the realm with the
> username concatenated.
>
> These correspond to
> KRB5_PADATA_ETYPE_INFO, KRB5_PADATA_ENC_TIMESTAMP, and 15 is not
> documented (??)
>
> Anyone know about PADATA type 15?
>
> in article [EMAIL PROTECTED], Sam Hartman at [EMAIL PROTECTED]
> wrote on 2/3/03 8:28 AM:
>
>>>>>>> "Wood," == Wood, Justin S <[EMAIL PROTECTED]> writes:
>> Wood,> Perhaps I've missed the point, but should it not be
>> Wood,> possible to configure the client to always send preauth,
>> Wood,> and hence remove the initial redundant protocol
>> Wood,> interaction?
>>
>> I believe that current APIs allow this, but kinit does not currently
>> implement that feature.
>>
>> In future, it will be less useful as the client will need more
>> information from the KDC to make a correct guess about what preauth or
>> encryption types to use.
>>
>> So you should not expect to see anyone actually exposing this support
>> in kinit.
>>
>> ________________________________________________
>> Kerberos mailing list [EMAIL PROTECTED]
>> https://mailman.mit.edu/mailman/listinfo/kerberos
>>
>
>
________________________________________________
Kerberos mailing list [EMAIL PROTECTED]
https://mailman.mit.edu/mailman/listinfo/kerberos
