krb5 with java (JAAS) problem identified... sort of

[Sam Hartman]

>>>>> "david" == david  <david at cobite.com> writes:

    david> (1.2.2 and 1.2.7 respectively) using Java (sun jdk 1.4.2

    david> While I don't know the cause, I know a workaround.  When
    david> initially configuring the krb5 kdc, you must place
    david> des-cbc-crc:normal before des-cbc-crc:v4, or simply remove
    david> des-cbc-crc:v4 from the kdc.conf file (supported_enctypes
    david> in [realms] stanza)

    david> After changing this, it all works fine for me.  It's either
    david> a bug in the v4 salt handling in krb5 or java it would
    david> seem.  But who knows...

I'd guess a bug in the Java stuff.  That's one of the common things to
get wrong when implementing Kerberos.  But moving your v4 salted key
later should be completely harmless.