Wrong ticket encryption for W2K clients only
Markus Moeller
huaraz at moeller.plus.com
Mon Aug 6 14:51:40 EDT 2007
Is there a reason that you still use DES ? As far as I know
Vintella/Wedgetail supports RC4.
Markus
"Ron Perzul" <rperzul at businessobjects.com> wrote in message
news:D8517328071C7A48BAA4DE1799D0DE4322B849 at exch-lv05.intl.businessobjects.com...
> Hi,
>
> I am facing the following problem.
>
> The Windows service account used for Vintela SSO is set up using "Use DES
> encryption for this account". The keytab is created with ktpass
> ... -crypto DES-CBC-MD5 encryption.
>
> Everything is working when I login to the web application from a Windows
> 2003 server machine. On the Windows 2003 server machine part of the klist
> tickets command is as follows (Kerberos ticket encryption of type
> DES-CBC-MD5 as expected):
>
> Server: HTTP/server.eu.xxx.com at EU.XXX.COM
> KerbTicket Encryption Type: Kerberos DES-CBC-MD5
> End Time: 8/3/2007 21:38:37
> Renew Time: 8/10/2007 11:38:37
>
> But on the Windows 2000 clients the ticket is encrypted with RC4-HMAC-NT:
>
> Server: HTTP/server at EU.XXX.COM
> KerbTicket Encryption Type: Kerberos RSADSI RC4-HMAC(NT)
> End Time: 8/3/2007 21:42:55
> Renew Time: 8/10/2007 11:42:55
>
> The wrong obtained ticket causes SSO to fail.
>
> Tomcat output is:
>
> HTTP Status 500 - com.wedgetail.idm.sso.ProtocolException:
> com.wedgetail.idm.spnego.server.SpnegoException: GSSException: Failure
> unspecified at GSS-API level (Mechanism level:
> com.dstc.security.kerberos.KerberosException: Successfully matched service
> principal " HTTP/SERVER.EU.XXX.COM at EU.XXX.COM but not key type (23) + KVNO
> (2) in this entry: Principal: HTTP/SERVER.EU.XXX.COM at EU.XXX.COM Type: 1
> TimeStamp: Wed Dec 31 19:00:00 EST 1969 KVNO: -1 Key: [3, 67 ec a8 a8 75
> e0 ab 3e ] )
>
> So the encryption type of the client ticket (which is of type
> 23=RC4-HMAC-NT) does not match the entry in the keytab (type
> 3=DES-CBC-MD5).
>
> Why does the Windows 2000 machine get a different encrypted ticket? Also,
> there is a difference in the SPN returned in the output of the klist
> tickets above.
>
> Any help would be greatly appreciated.
>
> Thanks,
>
> Ron
>
> ________________________________________________
> Kerberos mailing list Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>
More information about the Kerberos
mailing list