Please Review Changes to Windows Exports List for krb5 1.2.5 in KfW 2.2

[Nicolas Williams]

Hmmm, is it possible to disinguish KRB5_NO_XREALM_PATH from
KDC_ERR_S_PRINCIPAL_UNKNOWN based on what creds are returned by
krb5_get_cred_from_kdc_*()?

I'm assuming that krb5_get_cred_from_kdc_*() does return any TGTs
obtained along the way - it looks that way. So then:

if (cmp(client->realm, server->realm) != 0 &&
    ntgts > 0 && cmp(server->realm, (tgts[ntgts - 1])->server->realm) != 0)
	/*
	 * No x-realm path - try any creds for other realms that the
	 * user might have.
	 */
	continue;

This way you need no mods to MIT krb5/kfw.

Cheers,

Nico


On Tue, Apr 16, 2002 at 12:15:57PM -0400, Jeffrey Altman wrote:
> yes.  This would work for me.
> 
> > Yes, but, you know which principals the user has, yes?
> > 
> > So a new error, say KRB5_NO_XREALM_PATH, would suffice for you to
> > detect which credentials to use for which target services' realms. After
> > all, you complained that the server not found error is mostly useless -
> > would not KRB5_NO_XREALM_PATH be sufficiently useful?
> > 
> > Cheers,
> > 
> > Nico
> > 
> > On Tue, Apr 16, 2002 at 11:27:08AM -0400, Jeffrey Altman wrote:
> > > 
> > > You can have multiple credential caches.  And that is fine.  The issue
> > > is that I might not have credentials for the service the user wants to
> > > connect to.  But the user can get them.  If I knew which realm the
> > > user needed to authenticate to, then I can prompt the user to get the
> > > correct credentials for the connection she wisheds to make.  But
> > > without the ability to determine the correct realm I have to throw my
> > > hands up in the arm.
> > -- 
> > -DISCLAIMER: an automatically appended disclaimer may follow. By posting-
> > -to a public e-mail mailing list I hereby grant permission to distribute-
> > -and copy this message.-
> > 
> > Visit our website at http://www.ubswarburg.com
> > 
> > This message contains confidential information and is intended only 
> > for the individual named.  If you are not the named addressee you 
> > should not disseminate, distribute or copy this e-mail.  Please 
> > notify the sender immediately by e-mail if you have received this 
> > e-mail by mistake and delete this e-mail from your system.
> > 
> > E-mail transmission cannot be guaranteed to be secure or error-free 
> > as information could be intercepted, corrupted, lost, destroyed, 
> > arrive late or incomplete, or contain viruses.  The sender therefore 
> > does not accept liability for any errors or omissions in the contents 
> > of this message which arise as a result of e-mail transmission.  If 
> > verification is required please request a hard-copy version.  This 
> > message is provided for informational purposes and should not be 
> > construed as a solicitation or offer to buy or sell any securities or 
> > related financial instruments.
> > 
> 
> 
> 
>  Jeffrey Altman * Sr.Software Designer      Kermit 95 1.1.21  available now!!!
>  The Kermit Project @ Columbia University   SSH plus Telnet, FTP and HTTP
>  http://www.kermit-project.org/             secured with Kerberos, SRP, and 
>  kermit-support at columbia.edu                OpenSSL.
> _______________________________________________
> krbdev mailing list             krbdev at mit.edu
> http://mailman.mit.edu/mailman/listinfo/krbdev
-- 
-DISCLAIMER: an automatically appended disclaimer may follow. By posting-
-to a public e-mail mailing list I hereby grant permission to distribute-
-and copy this message.-

Visit our website at http://www.ubswarburg.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.

E-mail transmission cannot be guaranteed to be secure or error-free 
as information could be intercepted, corrupted, lost, destroyed, 
arrive late or incomplete, or contain viruses.  The sender therefore 
does not accept liability for any errors or omissions in the contents 
of this message which arise as a result of e-mail transmission.  If 
verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities or 
related financial instruments.