Microsoft Active Directory / PKINIT
Tim Alsop
Tim at cybersafe.com
Thu Aug 12 15:44:47 EDT 2010
Greg,
Thankyou. I hoped this was the case, but wasn't sure.
Regards,
Tim
-----Original Message-----
From: Greg Hudson [mailto:ghudson at mit.edu]
Sent: 12 August 2010 20:15
To: Tim Alsop
Cc: kerberos at mit.edu
Subject: Re: Microsoft Active Directory / PKINIT
On Thu, 2010-08-12 at 07:26 -0400, Tim Alsop wrote:
> Also, I am interested to know about interoperability between the
> draft-9 implementation and the RFC 4556 implementation. For example,
> does the PKINIT included in the MIT code, which is RFC compliant
> interoperate with MS AD (draft-9) ?
The PKINIT code in MIT krb5 attempts to interoperate with MS AD, and to the best of my knowledge does so, although we don't regularly test that scenario.
(That's the result of a lot of deliberate code, though; draft-9 and the RFC implementation are not interoperable, and I believe they use different preauth codes as a result of there being draft-9 implementations in the field.)
More information about the Kerberos
mailing list