Subject: [Wocky] Server Updated?

From: Patrick McNeal <[email-masked]>
Date: Wed, 2 Apr 2008 10:51:54 -0400

It looks like our Jabber server was updated, as Adium 1.2.4 is now  
able to connect with either plain+ssl or kerberos ( yay! ).

Has anyone been able to get iChat on 10.5 to connect to the server  
with Kerberos?  When I enable "Kerberos v5 for authentication" iChat  
complains about not being able to verify the identity of  
jabber.mit.edu.  Maybe it has something to do with the server still  
using a self signed cert?

--Patrick

---

From: Quentin Smith <[email-masked]>
Date: Wed, 2 Apr 2008 11:00:02 -0400 (EDT)

> able to connect with either plain+ssl or kerberos ( yay! ).

Hi Patrick,

What Adium configuration did you use to enable Kerberos authentication?

Thanks,
--Quentin

> _______________________________________________
> Wocky mailing list
> [email-masked]
> http://mailman.mit.edu/mailman/listinfo/wocky
>

---

From: Quentin Smith <[email-masked]>
Date: Wed, 2 Apr 2008 11:12:57 -0400 (EDT)

Aha. I was still using Adium 1.2.3. I can confirm that those settings 
*don't* work in 1.2.3. Updating to 1.2.4 made those settings work great.

Thanks!
--Quentin

On Wed, 2 Apr 2008, Patrick McNeal wrote:

>
> On Apr 2, 2008, at 11:00 AM, Quentin Smith wrote:
> With a valid edu.mit.kerberos file installed in /Library/Preferences, Jabber 
> prompted me at lunch to get a TGT with these settings:
>

---

From: Patrick McNeal <[email-masked]>
Date: Wed, 2 Apr 2008 11:07:41 -0400

> What Adium configuration did you use to enable Kerberos  

With a valid edu.mit.kerberos file installed in /Library/Preferences,  
Jabber prompted me at lunch to get a TGT with these settings:

With an existing, valid TGT, Adium just connects as expected.  Note -  
these are the default settings we'll be using in the updated Adium  
installer we're currently working on.

---

From: Greg Hudson <[email-masked]>
Date: Wed, 02 Apr 2008 11:25:15 -0400

> Jabber prompted me at lunch to get a TGT with these settings:

You can stop listing jabber.mit.edu as the connect server; Adium can now
do a SRV lookup and figure that out.

(This setting is also what was preventing Kerberos authentication to
work for Quentin, and it might start interfering with Kerberos
authentication again in the future, because of an obscure technical
issue involving Digest-MD5 authentication.)

---

From: Patrick McNeal <[email-masked]>
Date: Wed, 2 Apr 2008 11:28:57 -0400

On Apr 2, 2008, at 11:25 AM, Greg Hudson wrote:
> issue involving Digest-MD5 authenticatio

I just changed the connect to server to "mit.edu" and Adium 1.2.4 no  
longer connects.  It fails with "socket not connected."

---

From: Jacob Morzinski <[email-masked]>
Date: Wed, 02 Apr 2008 11:38:46 -0400

I removed my connect server setting, left it blank.
When I restarted Adium, Adium seems to work with the blank
connect server..

However, now I'm getting error/warning messages that
"Adium can't verify the identity of "mit.edu",
or "jabber.mit.edu".  These confuse me, because I don't remember
getting those before.  I wonder if certificates are being
actively replaced on the server.

 -Jacob

-- 
Jacob Morzinski <[email-masked]>
Client Support Services
Information Services and Technology

---

From: Ken Raeburn <[email-masked]>
Date: Wed, 2 Apr 2008 11:39:30 -0400

> longer connects.  It fails with "socket not connected."

Right, mit.edu is a different machine, not the right one to connect  
to.  If you leave the field blank, Adium will query DNS for the right  
jabber server to use for @mit.edu jabber ids; the current DNS data  
will tell it to connect to jabber.mit.edu.

It's working for me as well (yay!) on my new Leopard box, though I'm  
also seeing the certificate complaints.  (BTW, don't even bother  
trying the Zephyr support on Leopard; it crashes because Leopard  
doesn't have the krb4 support any more, and we haven't switched to the  
krb5 port of Zephyr that some other sites are running.)

Ken

---

From: Patrick McNeal <[email-masked]>
Date: Wed, 2 Apr 2008 11:50:35 -0400

> will tell it to connect to jabber.mit.edu.

Thanks for the clarification - removing the server name completely,  
I'm able to connect.

> also seeing the certificate complaints.

Anyone on the list know the status of getting a real, or at least MIT  
signed, cert installed on the server?

---

From: "Andrew Munchbach" <[email-masked]>
Date: Wed, 2 Apr 2008 11:27:18 -0400

No luck with Leopard with any port or settings when Kerberos is used.  I get
an SSL error.
_A

-- 
Andrew Munchbach
Consultant - Departmental IT Resources Group
Massachusetts Institute of Technology
77 Massachusetts Ave | Cambridge, MA 02139
Building E19-630
[email-masked]
(617) 253-0157

---

From: Bill Cattey <[email-masked]>
Date: Wed, 02 Apr 2008 15:08:02 -0400

I spoke with Steve Landry moments ago.

The OpenFire server was updated late last night.

I will re-confirm to him that we still need to remedy the self-signed
certificate issue.

-Bill