Re: Interoperating with Win2K

[Mark Davies <mark@MCS.VUW.AC.NZ>]

OK, making progress :-)

With the reverse mapping in the DNS sorted out things are now working in the 
previous setup with the w2k KDC.  So now I try cross realm with this setup:

Machine "a" in the w2k realm POC.VUW.AC.NZ (same machine as in my previous tests).
Machine "b" in a purely heimdal based realm MCS.VUW.AC.NZ
Cross-realm principles "krbtgt/MCS.VUW.AC.NZ@POC.VUW.AC.NZ" and 
"krbtgt/POC.VUW.AC.NZ@MCS.VUW.AC.NZ" set up in both realms KDC's.

telneting from "a" to "b" gives this error:

  Kerberos V5: mk_req failed (Decrypt integrity check failed)

telneting from "b" to "a" without adding the default_etypes entries to "b"s
krb5.conf gives this error:

  Kerberos V5: mk_req failed (KDC has no support for encryption type)

telneting from "b" to "a" with adding the default_etypes entries to "b"s
krb5.conf gives gives this error:

  Kerberos V5: mk_req failed (Message stream modified)

and do you really have to make that change to krb5.conf files for machines 
that aren't directly in a w2k managed realm?

So what still needs to be done?

cheers
mark