The PAC must be the first ad-element
iboukris at gmail.com
Fri Jan 31 07:46:36 EST 2020
When I recently confirmed that windows hosts have no problem with
other ad-elements along side the PAC, I was lazy to test change of
order. Today I tested it and found that Windows servers are not happy
when the PAC is not the first ad-if-relevant element.
The error is somewhat tricky, since the ldap bind succeeds using the
ticket, but subsequent search call fails with (see more details in:
"In order to perform this operation a successful bind must be
completed on the connection"
Technically the current KDC code looks alright, although maybe I'll
add a code comment and a test for it. But Alexander pointed out that
previous KDC code in v1.17 is not good as it would place CAMMAC as
first element (fixed in 7196c03f18f14695abeb5ae4923004469b172f0f).
More information about the krbdev