Re: Crash in gss_export_sec_contex in krb5-1.8.1 on OpenSuse 11.3

2010-12-28 Thread Greg Hudson
On Sun, 2010-12-26 at 08:03 -0500, Markus Moeller wrote: When I try to export a security context it sometime crashes in: Thanks for the diagnosis and test program. This is issue #6675: http://krbdev.mit.edu/rt/Ticket/Display.html?id=6675user=guestpass=guest which was reported to us a while

Re: some cross-realm trust questions

2010-12-28 Thread Victor Sudakov
Russ Allbery wrote: [dd] But it still escapes me how on earth I will end up with krbtgt/unix.re...@windows.realm and krbtgt/windows.re...@unix.realm having the same key. There is nothing in the above articles about exporting and importing keytabs. You use a password. Enter the same

Re: some cross-realm trust questions

2010-12-28 Thread Russ Allbery
Victor Sudakov v...@mpeks.no-spam-here.tomsk.su writes: Russ Allbery wrote: You use a password. Enter the same password on both sides when creating the key, and then be sure to remove any extraneous enctypes on the Heimdal side that AD isn't configured to provide. Do you mean to say that

Re: some cross-realm trust questions

2010-12-28 Thread Nicolas Williams
On Tue, Dec 28, 2010 at 05:02:45PM +, Victor Sudakov wrote: Russ Allbery wrote: You use a password. Enter the same password on both sides when creating the key, and then be sure to remove any extraneous enctypes on the Heimdal side that AD isn't configured to provide. Do you mean to

RE: some cross-realm trust questions

2010-12-28 Thread Wilper, Ross A
-Original Message- From: kerberos-boun...@mit.edu [mailto:kerberos-boun...@mit.edu] On Behalf Of Nicolas Williams Sent: Tuesday, December 28, 2010 11:58 AM To: Victor Sudakov Cc: kerberos@mit.edu Subject: Re: some cross-realm trust questions Our adjoin[0] script (which was referenced in

Re: some cross-realm trust questions

2010-12-28 Thread Nicolas Williams
On Tue, Dec 28, 2010 at 01:34:17PM -0800, Wilper, Ross A wrote: Our adjoin[0] script (which was referenced in a BigAdmin paper by Baban Kenkre[1]) implements a heuristic to detect what enctypes are available based on, IIRC, trying to add an LDAP attribute named