more text about afs, how to get get your KeyFile, and how to start use

2b tokens


git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@11598 ec53bebd-3082-4978-b11e-865c3cabbd6b

doc/misc.texi

@@ -57,8 +57,64 @@ A working solution would be to hook up a machine with a real operating
 system to the console of the Cisco and then use it as a backwards
 terminal server.
 
-@section Making things work on Transarc AFS
+@section Making things work on Transarc/OpenAFS AFS
 
 @subsection How to get a KeyFile
 
 @file{ktutil -k AFSKEYFILE:KeyFile get afs@@MY.REALM}
+
+or you can extract it with kadmin
+
+@example
+kadmin> ext -k AFSKEYFILE:/usr/afs/etc/KeyFile afs@My.CELL.NAME
+@end example
+
+You have to make sure you have a @code{des-cbc-md5} enctype since that
+is the key that will be converted.
+
+@subsection How to convert a srvtab to a KeyFile
+
+You need a @file{/usr/vice/etc/ThisCell} containing the cellname of you
+AFS-cell.
+
+@file{ktutil copy krb4:/root/afs-srvtab AFSKEYFILE:/usr/afs/etc/KeyFile}.
+
+If keyfile already exists, this will add the new key in afs-srvtab to
+KeyFile.
+
+@section Using 2b tokens with AFS
+
+@subsection What is 2b ?
+
+2b is the name of the proposal that was implemented to give basic
+Kerberos 5 support to AFS in rxkad. Its not real kerberos 5 support
+since it still uses fcrypt for data encryption and not kerberos
+encryption types.
+
+Its only possible (for all cases) to do this for DES enctypes because
+then the token (the AFS equivalent of a ticket) will be be smaller
+then the maximum size that can fit in the token cache in
+openafs/transarc client. Its so tight fit that some extra wrapping on the ASN1/DER encoding is removed from the kerberos ticket.
+
+2b uses a Kerberos 5 EncTicketPart instead of a kerberos 4 ditto for
+the part of the ticket that is encrypted with the service's key. The
+client/user doesn't know what inside the encrypted data so to it it
+doesn't matter.
+
+To diffrenceate between Kerberos 4 tickets and Kerberos 5 tickets 2b
+uses a special kvno, 213 for 2b tokens and 255 for Kerberos 5 tokens.
+
+Its a requirement that all AFS servers that support 2b also support
+native Kerberos 5 in rxkad.
+
+@subsection Configuring heimdal to use 2b tokens
+
+Support for 2b token are turned on for specific principals by adding
+them to the string list option @code{[kdc]use_2b} in the kdc's
+@file{krb5.conf} file.
+
+@example
+[kdc]
+	use_2b = afs@SU.SE
+	use_2b = afs/it.su.se@SU.SE
+@end example