UDP and fragmentation

[Nicolas Williams]

On Tue, Sep 14, 2010 at 04:45:25AM +0000, Victor Sudakov wrote:
> Greg Hudson wrote:
> > > BTW what can make Kerberos packets so big? Microsoft says: "Depending
> > > on a variety of factors including security identifier (SID) history
> > > and group membership, some accounts will have larger Kerberos
> > > authentication packet sizes." What's there inside? Long principal
> > > names? Long keys?
> 
> > An Active Directory KDC will include authorization data within a
> > Kerberos ticket which includes the set of groups you are a member of.
> > If that's a lot of groups, then your ticket will be large.
> 
> It is very interesting. Where is room in a Kerberos ticket for
> such data?

In the authorization-data field [of EncTicketPart].  See RFC4120.

Nico
--