oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

When building a princ name pick a sane def type

Browse Source 
This is part of the fix to #173.  MSFT RODCs insist on the name type for
krbtgt principals be set to KRB5_NT_SRV_INST.

Commentary from Jeffrey Altman <jaltman@secure-endpoints.com>

As reported by David Mulder of Dell's Quest, Active Directory will
return a BAD_INTEGRITY error when a request for a krbtgt service
ticket is received with principal type NT-PRINCIPAL instead of NT-SRV-INST
as required by RFC 4120.

[Nico: RFC4120 does not require this.  See the description of the
       name-type field of PrincipalName on page 55.]

  ERROR: VAS_ERR_KRB5: Failed to obtain credentials.
  Client: SLED10-32$@F.QAS,
  Service: SLED10-32$@F.QAS, Server: ad2-f.f.qas
  Caused by: KRB5KRB_AP_ERR_BAD_INTEGRITY (-1765328353): Decrypt integrity check failed

Microsoft began enforcing principal type checking for RODCs in 2008R2.
Microsoft does state that ALL krgtgt/REALM tickets SHOULD be sent using
principal name type of KRB5_NT_SRV_INST instead of KRB5_NT_PRINCIPAL.

From Microsoft:

  "I believe we discovered the problem. There isn't a bug in Windows.
  There's been a code change to address another issue which puts in additional
  checks for Kerberos tickets. The problem is with the Unix clients when the
  client request a TGT. The Unix clients are using Name-type Principal
  [KRB_NT_PRINCIPAL (1)] instead of using Name-type Service and Instance
  [KRB_NT_SRV_INST (2)]...."

This change assigns the NT-SRV-INST principal type each time a krbtgt
service principal is created.  Unlike Microsoft, the Heimdal mostly does
not care about the name-type of any principals, with the exception of
referrals, where the name type is needed to decide how to find a
next-hop realm.
This commit is contained in:
Nicolas Williams
2016-11-11 16:31:46 -06:00
parent 84e959a752
commit a59bb7132f
3 changed files with 33 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
tests/gss/check-context.in
View File

@@ -178,8 +178,8 @@ ${context} --name-type=krb5-principal-name host/lucid.test.h5l.se@${R} || \
echo "plain (krb5 realmless)" ; > messages.log
${context} --name-type=krb5-principal-name host/lucid.test.h5l.se || \
{ eval "$testfailed"; }
echo "plain (krb5 realmless short-form should fail)" ; > messages.log
${context} --name-type=krb5-principal-name host/lucid 2>/dev/null && \
echo "plain (krb5 realmless short-form)" ; > messages.log
${context} --name-type=krb5-principal-name host/lucid 2>/dev/null || \
{ eval "$testfailed"; }
echo "creating short-form princ"
${kadmin} add -p p1 --use-defaults host/lucid@${R} || exit 1