GSSAPI s4u2proxy with client keytab initiation and Heimdal KDC

Sumit Bose sbose at
Fri Dec 6 05:36:56 EST 2013

On Thu, Dec 05, 2013 at 08:43:20PM -0500, Greg Hudson wrote:
> If you are in a position to conveniently test it, the following patch
> should fix FAST TGS against Windows 2008 or Heimdal KDCs (or pre-1.7 MIT
> KDCs), without having to disable FAST TGS client support:
> Christopher, thanks for reporting this problem back in March, and
> apologies that I didn't figure it out back then.

Thank you for the fast response.

I tested the patch with krb-1.11.3 and Windows 2008 and S4U2Self is
working as expected now. Tests with Windows 2012 are still working as

I wonder if having the same padata multiple times in a request might
confuse some KDCs which are able to handle FAST TGS?


More information about the Kerberos mailing list