|
|
@@ -1,5 +1,6 @@
|
|
|
|
@c $Id$
|
|
|
|
@c $Id$
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@node Windows compatibility, Programming with Kerberos, Kerberos 4 issues, Top
|
|
|
|
@node Windows compatibility, Programming with Kerberos, Kerberos 4 issues, Top
|
|
|
|
@comment node-name, next, previous, up
|
|
|
|
@comment node-name, next, previous, up
|
|
|
|
@chapter Windows compatibility
|
|
|
|
@chapter Windows compatibility
|
|
|
@@ -22,10 +23,10 @@ somewhat useful.
|
|
|
|
* Encryption types::
|
|
|
|
* Encryption types::
|
|
|
|
* Authorisation data::
|
|
|
|
* Authorisation data::
|
|
|
|
* Quirks of Windows 2000 KDC::
|
|
|
|
* Quirks of Windows 2000 KDC::
|
|
|
|
* Useful links when reading about the Windows 2000::
|
|
|
|
* Useful links when reading about the Windows::
|
|
|
|
@end menu
|
|
|
|
@end menu
|
|
|
|
|
|
|
|
|
|
|
|
@node Configuring Windows to use a Heimdal KDC, Inter-Realm keys (trust) between Windows and a Heimdal KDC, Windows compatability, Windows compatability
|
|
|
|
@node Configuring Windows to use a Heimdal KDC, Inter-Realm keys (trust) between Windows and a Heimdal KDC, Windows compatibility, Windows compatibility
|
|
|
|
@comment node-name, next, precious, up
|
|
|
|
@comment node-name, next, precious, up
|
|
|
|
@section Configuring Windows to use a Heimdal KDC
|
|
|
|
@section Configuring Windows to use a Heimdal KDC
|
|
|
|
|
|
|
|
|
|
|
@@ -82,7 +83,7 @@ The Windows machine will now map any user to the corresponding principal,
|
|
|
|
for example @samp{nisse} to the principal @samp{nisse@@MY.REALM}.
|
|
|
|
for example @samp{nisse} to the principal @samp{nisse@@MY.REALM}.
|
|
|
|
(This is most likely what you want.)
|
|
|
|
(This is most likely what you want.)
|
|
|
|
|
|
|
|
|
|
|
|
@node Inter-Realm keys (trust) between Windows and a Heimdal KDC, Create account mappings, Configuring Windows to use a Heimdal KDC, Windows compatability
|
|
|
|
@node Inter-Realm keys (trust) between Windows and a Heimdal KDC, Create account mappings, Configuring Windows to use a Heimdal KDC, Windows compatibility
|
|
|
|
@comment node-name, next, precious, up
|
|
|
|
@comment node-name, next, precious, up
|
|
|
|
@section Inter-Realm keys (trust) between Windows and a Heimdal KDC
|
|
|
|
@section Inter-Realm keys (trust) between Windows and a Heimdal KDC
|
|
|
|
|
|
|
|
|
|
|
@@ -173,7 +174,7 @@ Do not forget to reboot before trying the new realm-trust (after
|
|
|
|
running @command{ksetup}). It looks like it might work, but packets are
|
|
|
|
running @command{ksetup}). It looks like it might work, but packets are
|
|
|
|
never sent to the non-Windows KDC.
|
|
|
|
never sent to the non-Windows KDC.
|
|
|
|
|
|
|
|
|
|
|
|
@node Create account mappings, Encryption types, Inter-Realm keys (trust) between Windows and a Heimdal KDC, Windows compatability
|
|
|
|
@node Create account mappings, Encryption types, Inter-Realm keys (trust) between Windows and a Heimdal KDC, Windows compatibility
|
|
|
|
@comment node-name, next, precious, up
|
|
|
|
@comment node-name, next, precious, up
|
|
|
|
@section Create account mappings
|
|
|
|
@section Create account mappings
|
|
|
|
|
|
|
|
|
|
|
@@ -190,7 +191,7 @@ This adds @samp{authorizationNames} entry to the users LDAP entry to
|
|
|
|
the Active Directory LDAP catalog. When you create users by script you
|
|
|
|
the Active Directory LDAP catalog. When you create users by script you
|
|
|
|
can add this entry instead.
|
|
|
|
can add this entry instead.
|
|
|
|
|
|
|
|
|
|
|
|
@node Encryption types, Authorisation data, Create account mappings, Windows 2000 compatability
|
|
|
|
@node Encryption types, Authorisation data, Create account mappings, Windows compatibility
|
|
|
|
@comment node-name, next, previous, up
|
|
|
|
@comment node-name, next, previous, up
|
|
|
|
@section Encryption types
|
|
|
|
@section Encryption types
|
|
|
|
|
|
|
|
|
|
|
@@ -202,7 +203,7 @@ MD4 and DES keys. Users that are converted from a NT4 database, will
|
|
|
|
only have MD4 passwords and will need a password change to get a DES
|
|
|
|
only have MD4 passwords and will need a password change to get a DES
|
|
|
|
key.
|
|
|
|
key.
|
|
|
|
|
|
|
|
|
|
|
|
@node Authorisation data, Quirks of Windows 2000 KDC, Encryption types, Windows 2000 compatability
|
|
|
|
@node Authorisation data, Quirks of Windows 2000 KDC, Encryption types, Windows compatibility
|
|
|
|
@comment node-name, next, previous, up
|
|
|
|
@comment node-name, next, previous, up
|
|
|
|
@section Authorisation data
|
|
|
|
@section Authorisation data
|
|
|
|
|
|
|
|
|
|
|
@@ -230,7 +231,7 @@ the file.
|
|
|
|
analysing the data.
|
|
|
|
analysing the data.
|
|
|
|
@end enumerate
|
|
|
|
@end enumerate
|
|
|
|
|
|
|
|
|
|
|
|
@node Quirks of Windows 2000 KDC, Useful links when reading about the Windows 2000, Authorisation data, Windows 2000 compatability
|
|
|
|
@node Quirks of Windows 2000 KDC, Useful links when reading about the Windows, Authorisation data, Windows compatibility
|
|
|
|
@comment node-name, next, previous, up
|
|
|
|
@comment node-name, next, previous, up
|
|
|
|
@section Quirks of Windows 2000 KDC
|
|
|
|
@section Quirks of Windows 2000 KDC
|
|
|
|
|
|
|
|
|
|
|
@@ -262,9 +263,9 @@ You should also add the following entries to the @file{krb5.conf} file:
|
|
|
|
These configuration options will make sure that no checksums of the
|
|
|
|
These configuration options will make sure that no checksums of the
|
|
|
|
unsupported types are generated.
|
|
|
|
unsupported types are generated.
|
|
|
|
|
|
|
|
|
|
|
|
@node Useful links when reading about the Windows 2000, , Quirks of Windows 2000 KDC, Windows compatability
|
|
|
|
@node Useful links when reading about the Windows, , Quirks of Windows 2000 KDC, Windows compatibility
|
|
|
|
@comment node-name, next, previous, up
|
|
|
|
@comment node-name, next, previous, up
|
|
|
|
@section Useful links when reading about the Windows 2000
|
|
|
|
@section Useful links when reading about the Windows
|
|
|
|
|
|
|
|
|
|
|
|
See also our paper presented at the 2001 Usenix Annual Technical
|
|
|
|
See also our paper presented at the 2001 Usenix Annual Technical
|
|
|
|
Conference, available in the proceedings or at
|
|
|
|
Conference, available in the proceedings or at
|
|
|
@@ -279,7 +280,7 @@ short list of the interesting documents that we have managed to find.
|
|
|
|
@uref{http://www.microsoft.com/technet/prodtechnol/windows2000serv/howto/kerbstep.mspx}.
|
|
|
|
@uref{http://www.microsoft.com/technet/prodtechnol/windows2000serv/howto/kerbstep.mspx}.
|
|
|
|
Kerberos GSS-API (in Windows-eze SSPI), Windows as a client in a
|
|
|
|
Kerberos GSS-API (in Windows-eze SSPI), Windows as a client in a
|
|
|
|
non-Windows KDC realm, adding unix clients to a Windows 2000 KDC, and
|
|
|
|
non-Windows KDC realm, adding unix clients to a Windows 2000 KDC, and
|
|
|
|
adding cross-realm trust (@pxref{Inter-Realm keys (trust) between Windows 2000
|
|
|
|
adding cross-realm trust (@pxref{Inter-Realm keys (trust) between Windows
|
|
|
|
and a Heimdal KDC}).
|
|
|
|
and a Heimdal KDC}).
|
|
|
|
|
|
|
|
|
|
|
|
@item Windows 2000 Kerberos Authentication:
|
|
|
|
@item Windows 2000 Kerberos Authentication:
|
|
|
|