[External] : Re: Windows Credential Guard with MSLSA

[Srinivas Cheruku]

Can you please help me with understanding your question?

Regarding Session 2 – are you saying that you are using Windows Credential Guard on Linux (which is acting as server application) to store the credentials and you want the MIT code to use these credentials to perform gss operations?
Can Windows Credential Guard be used on Linux?


Thanks,
Srini

From: krbdev <krbdev-bounces at mit.edu> on behalf of Seshan Parameswaran <seshan.parameswaran at oracle.com>
Date: Thursday, 7 September 2023 at 02:38
To: Sam Hartman <hartmans at debian.org>, krbdev at mit.edu <krbdev at mit.edu>
Subject: Re: [External] : Re: Windows Credential Guard with MSLSA
Hi Sam
Let me make it clear.

I am using Linux Server / MIT Libraries for server and Windows Client .  Microsoft Active Directory as KDC Host.

Scenario – 1
Credential cache stored with MSLSA – AllowTGTSessionKey<https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-protocol-registry-kdc-configuration-keys> registry setting can be used to allow the Linux Kerberos MIT library  to retrieve credential cache from KDC Host for forwardable TGTs.

Scenario-2

Credential cache stored with Windows Credential Guard -  Do not know of any solution that allows Linux Kerberos MIT library to retrieve cache from the Windows Credential Guard as it uses signed certificates.  Looking for a solution.

Hope that helps.

Seshan

From: Sam Hartman <hartmans at debian.org>
Date: Wednesday, September 6, 2023 at 1:58 PM
To: Seshan Parameswaran <seshan.parameswaran at oracle.com>, krbdev at mit.edu <krbdev at mit.edu>
Subject: Re: [External] : Re: Windows Credential Guard with MSLSA
>>>>> "Seshan" == Seshan Parameswaran <seshan.parameswaran at oracle.com> writes:

    Seshan> I am running on Oracle Enterprise Linux and using MIT
    Seshan> libraries.  I am aware of the AllowTgtSessionKey Registry
    Seshan> setting parameter that works when MSLSA is used without the
    Seshan> Credential Guard.  My query is specific to MSLSA used with
    Seshan> Windows Credential Guard.

Your question doesn't make sense.
MSLSA is not a Linux thing:
MS -> Microsoft
LSA -> local security authority

The LSA exists on Windows systems.
If you are not on a Windows system, you don't have one.

It may be that you want to be asking about credential guard and Linux.
But involvind MSLSA or LSA in the discussion only confuses everyone.
_______________________________________________
krbdev mailing list             krbdev at mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev