Cross realm authentication

Fri Jan 7 06:03:18 EST 2011

<HTML><HEAD><TITLE>Samsung Enterprise Portal mySingle</TITLE>
<META content="text/html; charset=utf-8" http-equiv=Content-Type>
<STYLE id=mysingle_style type=text/css>P {
	MARGIN-TOP: 5px; FONT-FAMILY: Arial, arial; MARGIN-BOTTOM: 5px; FONT-SIZE: 9pt
}
TD {
	MARGIN-TOP: 5px; FONT-FAMILY: Arial, arial; MARGIN-BOTTOM: 5px; FONT-SIZE: 9pt
}
LI {
	MARGIN-TOP: 5px; FONT-FAMILY: Arial, arial; MARGIN-BOTTOM: 5px; FONT-SIZE: 9pt
}
BODY {
	LINE-HEIGHT: 1.4; MARGIN: 10px; FONT-FAMILY: Arial, arial; FONT-SIZE: 9pt
}
</STYLE>

<META name=GENERATOR content=ActiveSquare></HEAD>
<BODY>
Hi Mark,
Thank you&nbsp;for your timely response and explaination.
Also i will be good if you please share&nbsp; some links/pdf on kerberos cross realm authentication
w.r.t. requests and implementation details&nbsp; like the requests going out form client .
&nbsp;
Regards
Naveen
------- Original Message -------
Sender : Mark Pr�hl&lt;mark at mproehl.net&gt;
Date : Jan 07, 2011 19:33 (GMT+09:00)
Title : Re: Cross realm authentication
&nbsp;On 01/06/2011 05:02 AM, krbmit siso wrote: &gt; Hi Mark, &gt; &gt; Please find the attached capture for cross realm setup . I did not &gt; understand why do you require &gt; 2 TGS-REQ going from client , please shed some light on the same . the following sketch shows the principals involved in cross realm authentication: &nbsp;&nbsp;&nbsp;&nbsp;cient&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; realm-1 KDC &nbsp;&nbsp;&nbsp;&nbsp;client at REALM1&nbsp;&nbsp;-&gt;&nbsp;&nbsp; krbtgt/REALM1 at REALM1 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;^ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;| &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TRUST &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;krbtgt/REALM2 at REALM1 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;krbtgt/REALM1 at REALM2 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;| &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;v &nbsp;&nbsp;&nbsp;&nbsp; service &lt;-&nbsp;&nbsp; realm-2KDC &nbsp;&nbsp;&nbsp;&nbsp; service at REALM2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;krbtgt/REALM2 at REALM2 cross realm authentication usually works this way (scenario-1): step 1: client requests a TGT in his realm: AS-REQ/AS-REP for krbtgt/REALM1 at REALM1 step 2: client decides that service belongs to REALM2 (by client configuration, dns topology or kdc referrals) step 3: client request a cross-realm TGT for REALM2 by TGS-REQ to realm-1 KDC: krbtgt/REALM2 at REALM1 step 4: client request a service ticket for service at REALM2 by TGS-REQ to realm-2 KDC. clients presents krbtgt/REALM2 at REALM1 that is why two TGS request are sent from a client in a typical scenario. your cross realm scenario (from wireshark capture) looks this way (scenario-2): step 1: client request a cross-realm TGT for REALM2 by AS-REQ to realm-1 KDC for krbtgt/REALM2 at REALM1 step 2: client request a service Ticket for service at REALM2 by TGS-REQ to realm-2 KDC. clients presents krbtgt/REALM2 at REALM1 that should work as well but is not the usual way. The problem could be caused by your client or the trust setup between the two windows domains. To test the trust setup you should simulate the client by using kinit and kvno from MIT Kerberos: simulate scenario-1: kinit client at REALM1; kvno service at REALM2 simulate scenario-2: kinit -S krbtgt/REALM2 at REALM1 client at REALM1; kvno service at REALM2 your krb5.conf or DNS SRV records should provide the configuration for both realms. if that works then your trust setup is ok. ________________________________________________ Kerberos mailing list&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Kerberos at mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos 
&nbsp;
&nbsp;
&nbsp;
<TABLE id=confidentialsignimg>
<TBODY>
<TR>
<TD NAMO_LOCK>
<IMG border=0 src="cid:EM6S04A24XEV at namo.co.kr" width=520></TD></TR></TBODY></TABLE></BODY></HTML><img src='http://ext.samsung.net/mailcheck/SeenTimeChecker?do=819bad59c7908697b2d7709a7a17502e1340377536ec945f4b240a564ff6e9cb7c86263f3d414723d2cb7c2a93c43c11a728c55b39cc59eacf878f9a26ce15a0' border=0 width=0 height=0 style='display:none'>