Crypto with the Kerberos Login Handler

[Rod Widdowson]

Frederic,

 

I eventually gave up on using krb against AD and I now use LDAP which works quite well - and as an added benefit relieves you from
having to map principals.

 

In a recent situation when I had to work against a (non AD) Krb I had to do the enable_weak_crypto thing as well as setting the 

 

default_tkt_enctypes = des-cbc-crc

default_tgs_enctypes = des-cbc-crc

 

in [libdefaults]

 

However, I should note that I am far from a being a Kerberos expert, and that you should think very seriously before enabling
weakened security on any system.

 

Rod

 

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of MOTTE Frederic
Sent: 20 December 2011 07:09
To: users at shibboleth.net
Subject: Crypto with the Kerberos Login Handler

 

Hi, 

I have a AD on a windows 2008R2 and the idp is on a debian (jdk 1.6.0_29-b11) 

I have some problem using the kerberos login handler. 
My first test was to create a keytab using the RC4-HMAC crypto. 
C:\Users\Administrateur>ktpass -princ HTTP/idp.cersso.com at CERSSO.COM -pass Master2008 -mapuser idp -out c:\temp\idp.http.keytab
-ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT  kvno 0 

When I use it on the debian platform to realise the kinit, it's OK but when I use is into the loginHandler configuration, I have a
checksum exception. In the wiki, the possible solutions are to activate the DES into the user profil or update the JKD version (if
under 1.5.xxx) 

consequently, I try to realise a keytab with the DES-CBC-MD5 crypto option, and  when I realise the kinit in order to validate the
keytab, I have the following error : 

kinit (v5), KDC has no support for encrytpion type while getting initial credentials. 

Can you help me in order to solve the crypto problem? 

Thanks for any help. 

Frederic 

 

[@@THALES GROUP RESTRICTED@@]

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20111220/72c5f274/attachment-0001.html