Authenticating debian users against AD

[Douglas E. Engert]

kerberos at noopy.org wrote:
> On Mon, Aug 10, 2009 at 9:39 AM, Douglas E. Engert<deengert at anl.gov> wrote:
>>
>> Javier Palacios wrote:
>>> Personally, I got many problems while using ktpass to create a keytab.
>> We don't use it either, but msktutil instead. But Jarek was using ktpass
>> so my suggestion was to understand what is going on under the covers
>> and use ktpass correctly.
> 
> I like msktutil a lot but it's not always the case that one has rights
> to change objects in AD. 

Then all of these tools are all but useless, as the intent is to create
a keytab that matches what is in AD. Most of these tools will change the password
to a random password, update AD, and create a keytab at the same time.
The password and the msDS-KeyVersionNumber in AD must be in sync with the the
key and KVNO in the keytab for Kerberos to work.

So only of you knew the password, KeyVersionNumber and salt could
you create a keytab that matched. I don't think that is his case.
If it was he could also use ktutil to create a keytab.

> ktpass.exe (when used w/SP2 under Windows
> 2003) *can* simplify the process of keytab creation but OTOH I don't
> think it solves the problem entirely/completely.

I think his problem was misunderstanding of how Kerberos works.

> 


-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444