Hi
I have been through many documents for several times but I just can't
seem to find the problem.
Here is the idea.
Users are defined in Active Directory (domain/realm WINDOWS.COM)
Host and service principals are defined in MIT Kerberos (realm
UNIX.COM).
Now I want the Windows users to be able to login to the Unix machines(
and thus the UNIX.COM realm).
Since users and host/service principals are in separated realms, cross
realm authentication should be set up, right?
So the point is that users XYZ (Windows Domain User) should be able to
logon to the Unix Machines.
1) Does the Windows user XYZ need to be defined in MIT Kerberos? I
presume that this is the case (although set with a random password).
2) Is something wrong with the given krb5.conf ?
[libdefaults]
default_realm = UNIX.COM
default_keytab_name = FILE:/etc/krb5/krb5.keytab
default_tkt_enctypes = des-cbc-md5 des-cbc-crc
default_tgs_enctypes = des-cbc-md5 des-cbc-crc
[realms]
UNIX.COM= {
kdc = server1.unix.com:88
admin_server = server1.unix.com:749
default_domain = unix.com
}
WINDOWS.COM= {
kdc = server1.windows.com:88
admin_server = server1.windows.com:749
default_domain = unix.com
}
[domain_realm]
.windows.com = WINDOWS.COM
windows.com = WINDOWS.COM
.unix.com = UNIX.COM
unix.com = UNIX.COM
[capaths]
WINDOWS.COM = {
UNIX.COM = .
}
UNIX.COM = {
WINDOWS.COM = .
}
3) In kdc.conf I edited the following
master_key_type = des-cbc-md5
supported_enctypes = des-cbc-md5:normal des-cbc-crc:normal
4) In MIT Kerberos I defined krbtgt/[EMAIL PROTECTED] and
krbtgt/[EMAIL PROTECTED] principals with password ABC
5) In Active Directory I defined the MIT realm and MIT kerberos master
with ksetup
>ksetup
default realm = windows.com (NT Domain)
UNIX.COM:
kdc = server1.unix.com
Realm Flags = 0x0 none
Mapping [EMAIL PROTECTED] to XYZ
6) In Active Directory I defined the realm trust (one way, incoming)
with the password ABC
7) In Active Directory Users and Computers I created the name mapping
for user XYZ to [EMAIL PROTECTED] (since the mapping set up by ksetup wasn't
visible here, did this just to be sure)
Now why can't user [EMAIL PROTECTED] login successfully with his Windows
password?
I am quite desperate on this one. What am I missing?
Any help would be greatly appreciated.
Kind regards
Miguel
________________________________________________
Kerberos mailing list [email protected]
https://mailman.mit.edu/mailman/listinfo/kerberos
