Hi,
I'd like to find out if there is any way to extract a HOST keytab for
a windows computer that is already a member of an active directory
domain.
A Java developer I look after wants to do the single sign on thing to
his web application. Our environment is a mixed Active Directory and
Edward Irvine wrote:
Hi,
I'd like to find out if there is any way to extract a HOST keytab for
a windows computer that is already a member of an active directory
domain.
Do you have to be use the Windows host principal? Can your application
use a different principal, like HTTP or LDAP
It could then impersonate any user to the machine
Can you explain that. I want to make sure I understand all potential
kerb threats, this is a new one to me.
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On
Behalf Of Douglas E. Engert
Sent: Wednesday, July 23,
On Wed, Jul 23, 2008 at 3:59 AM, Edward Irvine [EMAIL PROTECTED] wrote:
Hi,
I'd like to find out if there is any way to extract a HOST keytab for
a windows computer that is already a member of an active directory
domain.
A Java developer I look after wants to do the single sign on thing to
Paul Moore wrote:
It could then impersonate any user to the machine
Can you explain that. I want to make sure I understand all potential
kerb threats, this is a new one to me.
This is at the heart of Kerberos. Client and server trust KDC and trust
KDC to give service ticket to client
On Wed, Jul 23, 2008 at 02:01:43PM -0400, Michael B Allen wrote:
Extracting the keys from AD is not possible [1].
Nor ist it possible to extract them from MIT krb5 KDCs.
However, the ktpass utility from MS can set the password, generate the
corresponding key separately and put it into a
Nicolas Williams [EMAIL PROTECTED] writes:
On Wed, Jul 23, 2008 at 02:01:43PM -0400, Michael B Allen wrote:
Extracting the keys from AD is not possible [1].
Nor ist it possible to extract them from MIT krb5 KDCs.
It is as of 1.6 using kadmin.local (not that this changes the rest of your
On Wed, Jul 23, 2008 at 05:55:20PM -0700, Russ Allbery wrote:
Nicolas Williams [EMAIL PROTECTED] writes:
On Wed, Jul 23, 2008 at 02:01:43PM -0400, Michael B Allen wrote:
Extracting the keys from AD is not possible [1].
Nor ist it possible to extract them from MIT krb5 KDCs.
It is as
