Re: Heimdal with Solaris 8 clients, amonst other things

[Nicolas Williams <Nicolas.Williams@ubsw.com>]

On Wed, Apr 17, 2002 at 11:18:57AM -0400, Nicolas Williams wrote:
> Try removing requires_preauth on the principal in question or try
> forcing the client to always do pre-auth. If that works then the problem
> is this: the KDC lists des3-cbc-sha1 first in the ETYPE-INFO in the
> requires-preauth error response to the initial AS-REQ even though the
> AS-REQ did not list des3-cbc-sha1 in the requested enctypes list.

BTW, it's perfectly legal for the KDC to behave in this way, so the bug
is really in the MIT krb5 client code - it gives up too soon when
looking at the ETYPE-INFO. But there's no reason that the KDC couldn't
limit the ETYPE-INFO to a strict subset of the requested enctypes (this
is what MIT has settled on) or sort the ETYPE-INFO so that the requested
enctypes are listed first (my initial approach).

Cheers,

Nico
-- 
-DISCLAIMER: an automatically appended disclaimer may follow. By posting-
-to a public e-mail mailing list I hereby grant permission to distribute-
-and copy this message.-

Visit our website at http://www.ubswarburg.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.

E-mail transmission cannot be guaranteed to be secure or error-free 
as information could be intercepted, corrupted, lost, destroyed, 
arrive late or incomplete, or contain viruses.  The sender therefore 
does not accept liability for any errors or omissions in the contents 
of this message which arise as a result of e-mail transmission.  If 
verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities or 
related financial instruments.