kerberos authentication doesn't work agsint windows 2003 AD...

[swbell]

in article 1125443243.11580.26.camel at jurassic.mvcorp.xsigo.com, Kent Wu at
kwu at xsigo.com wrote on 8/30/05 6:07 PM:

For the principal name format to work when binding, the user's Active
Directory record must have that string in the userPrincipalName attribute.
Some domains that got migrated from NT 4 don't have this info set.

> Hi guys,
> 
> Thanks for all the inputs I've got so far. And
> I've figured out the reason behind it. The reason is that
> in the last ldap_sasl_bind_s() step, AD 2000 accepts the
> DN format like "kwu at blabla.COM" however AD 2003 only
> accepts format like "cn=Kent Wu,cn=Users,dc=blabla,dc=com".
> Not sure why AD 2003 wants to change this criterion however
> after I used the latter format it was working fine.
> 
> The error message "Invalid credentials" was
> referring to the wrong DN instead of bad password/key.
> I was thinking in the total opposite direction before and
> all of sudden I came across this "wrong DN" idea!
> 
> Cheers.
> 
> -Kent
> 
> On Mon, 2005-08-29 at 19:13 -0700, Kent Wu wrote:
>> Hi guys,
>> 
>> I used to write a program to authenticate
>> users against windows 2000 AD by using MIT
>> Kerberos/GSSAPI SDK as well as SUN LDAP SDK. Basically
>> what I did is to authenticate users against AD by
>> using kerberos before doing LDAP search operations.
>> It was working perfectly until I wanted to migrate the
>> 2000 AD to 2003 a wk ago.
>> 
>> While doing kerberos authentication against
>> AD 2003, the last step of ldap_sasl_bind_s() always
>> returns "invalid credentials" even though I've successfully
>> got TGT as well as the service ticket for LDAP (AD 2003). If
>> I type "klist" right before the last ldap_sasl_bind_s() step,
>> I can see the followings and it's looking look.
>> 
>> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
>> 
>> Default principal: KWU at DOMAIN
>> 
>> Valid starting     Expires            Service principal
>> 08/29/05 18:09:59  08/30/05 04:09:59  krbtgt/DOMAIN at DOMAIN
>>         renew until 08/30/05 18:09:59
>> 08/29/05 18:10:01  08/30/05 04:09:59  ldap/AD-HOSTNAME.DOMAIN at DOMAIN
>>         renew until 08/30/05 18:09:59
>> 
>> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
>> 
>> However it still fails in the last ldap_sasl_bind_s() call.
>> 
>> My calling sequence is like this:
>> 
>> 1. use Kerberos APIs to get/store TGT.
>> 2. use GSS-API (gss_init_sec_context()) and LDAP SDK SASL
>> (ldap_sasl_bind_s()) to engage kerberos authentication.
>> Basically I pass "GSSAPI" to ldap_sasl_bind_s() call and it
>> requires a loop (a couple of handshaking steps) to complete
>> the whole authentication process. It was working all good until
>> the last ldap_sasl_bind_s() call....
>> 
>> I've looked high and low on the internet and tried variety of
>> configurations in both client and server side however ended up
>> nothing. It's so weird that it works fine with AD 2000 but not
>> 2003....
>> 
>> Can anyone help me out by sharing his/her own experience or
>> pointing me to the right direction?
>> 
>> Thanks a lot in advance !
>> 
>> -Kent
>> 
>> 
>> 
>> 
>>