[kitten] MIT krb5 1.15 interop with Windows 2003 R2 SP2
Weijun Wang <weijun.wang@oracle.com> Tue, 19 September 2017 13:23 UTC
Return-Path: <weijun.wang@oracle.com>
X-Original-To: kitten@ietfa.amsl.com
Delivered-To: kitten@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8CFA4134302 for <kitten@ietfa.amsl.com>; Tue, 19 Sep 2017 06:23:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.001
X-Spam-Level:
X-Spam-Status: No, score=-7.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H2=-2.8, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XHnz7806pIqz for <kitten@ietfa.amsl.com>; Tue, 19 Sep 2017 06:23:17 -0700 (PDT)
Received: from userp1040.oracle.com (userp1040.oracle.com [156.151.31.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91569134301 for <kitten@ietf.org>; Tue, 19 Sep 2017 06:23:17 -0700 (PDT)
Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by userp1040.oracle.com (Sentrion-MTA-4.3.2/Sentrion-MTA-4.3.2) with ESMTP id v8JDNGDX024397 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for <kitten@ietf.org>; Tue, 19 Sep 2017 13:23:17 GMT
Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id v8JDNGqc006532 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for <kitten@ietf.org>; Tue, 19 Sep 2017 13:23:16 GMT
Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id v8JDNFAY014365 for <kitten@ietf.org>; Tue, 19 Sep 2017 13:23:16 GMT
Received: from [192.168.1.101] (/111.196.138.93) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Tue, 19 Sep 2017 06:23:15 -0700
From: Weijun Wang <weijun.wang@oracle.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Date: Tue, 19 Sep 2017 21:23:08 +0800
Message-Id: <C13E46E7-946B-4850-9920-F99DFD763145@oracle.com>
To: kitten <kitten@ietf.org>
X-Mailer: Apple Mail (2.3273)
X-Source-IP: aserv0021.oracle.com [141.146.126.233]
Archived-At: <https://mailarchive.ietf.org/arch/msg/kitten/g5Dy-si7JzmP6z_XP21eclgX8Z4>
Subject: [kitten] MIT krb5 1.15 interop with Windows 2003 R2 SP2
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/kitten/>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 19 Sep 2017 13:23:23 -0000
Hi All I am trying out MIT krb5 1.15 and using its kinit to login to a Windows 2003 R2 SP2 AD domain. The command fails with kinit: KDC has no support for encryption type while getting initial credentials After some more experiments, it seems that whenever I put the aes256-sha2 etype before rc4-hmac in default_tkt_enctypes, the same error happens. It is interesting that aes128-sha2 has no such effect. The latest Heimdal kinit shows the same interop issue. Precisely, the server does not complain with its 1st PREAUTH_REQUIRED response, and in my 2nd AS-REQ, if I provide a wrong password, the error is a normal PASSWORD_INCORRECT. Only if I provide the correct password it returns this error. Seems like it decides to choose etype of 20 but only realize it's not supported after some time. Is this a known issue? I tried Windows 2008 and Windows 2000 and have not seen the same error. Thanks Max