oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

When building a princ name pick a sane def type

Browse Source 
This is part of the fix to #173.  MSFT RODCs insist on the name type for
krbtgt principals be set to KRB5_NT_SRV_INST.

Commentary from Jeffrey Altman <jaltman@secure-endpoints.com>

As reported by David Mulder of Dell's Quest, Active Directory will
return a BAD_INTEGRITY error when a request for a krbtgt service
ticket is received with principal type NT-PRINCIPAL instead of NT-SRV-INST
as required by RFC 4120.

[Nico: RFC4120 does not require this.  See the description of the
       name-type field of PrincipalName on page 55.]

  ERROR: VAS_ERR_KRB5: Failed to obtain credentials.
  Client: SLED10-32$@F.QAS,
  Service: SLED10-32$@F.QAS, Server: ad2-f.f.qas
  Caused by: KRB5KRB_AP_ERR_BAD_INTEGRITY (-1765328353): Decrypt integrity check failed

Microsoft began enforcing principal type checking for RODCs in 2008R2.
Microsoft does state that ALL krgtgt/REALM tickets SHOULD be sent using
principal name type of KRB5_NT_SRV_INST instead of KRB5_NT_PRINCIPAL.

From Microsoft:

  "I believe we discovered the problem. There isn't a bug in Windows.
  There's been a code change to address another issue which puts in additional
  checks for Kerberos tickets. The problem is with the Unix clients when the
  client request a TGT. The Unix clients are using Name-type Principal
  [KRB_NT_PRINCIPAL (1)] instead of using Name-type Service and Instance
  [KRB_NT_SRV_INST (2)]...."

This change assigns the NT-SRV-INST principal type each time a krbtgt
service principal is created.  Unlike Microsoft, the Heimdal mostly does
not care about the name-type of any principals, with the exception of
referrals, where the name type is needed to decide how to find a
next-hop realm.
This commit is contained in:
Nicolas Williams
2016-11-11 16:31:46 -06:00
parent 84e959a752
commit a59bb7132f
3 changed files with 33 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
lib/krb5/test_pknistkdf.c
View File

@@ -244,6 +244,14 @@ test_dh2key(krb5_context context, int i, struct testcase *c)
ret = krb5_parse_name(context, c->server, &server);
if (ret)
krb5_err(context, 1, ret, "parse_name: %s", c->server);
/*
* Making krb5_build_principal*() set a reasonable default principal
* name type broke the test vectors here. Rather than regenerate
* the vectors, and to prove that this was the issue, we coerce the
* name types back to their original.
*/
krb5_principal_set_type(context, client, KRB5_NT_PRINCIPAL);
krb5_principal_set_type(context, server, KRB5_NT_PRINCIPAL);
if (verbose_flag) {
char *str;