Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Received-SPF: pass (athena.apache.org: domain of ayyagarikiran@gmail.com
 designates 209.85.210.178 as permitted sender)
MIME-Version: 1.0
Sender: ayyagarikiran@gmail.com
In-Reply-To: 
 <CADTpmS6M1vE33bF=sn1gdmOwmOR9WdUOHh1UrZ6N5NVKJx6g4A@mail.gmail.com>
References: 
 <CADTpmS6M1vE33bF=sn1gdmOwmOR9WdUOHh1UrZ6N5NVKJx6g4A@mail.gmail.com>
Date: Sun, 15 Jan 2012 03:12:19 +0530
Message-ID: 
 <CABzFU-fBN9DmMRX2AYHrDdu0YFV=o7M7bs_3wbYEkc7PYC1rjA@mail.gmail.com>
Subject: Re: Default encryptionTypes for KdcServer
From: Kiran Ayyagari <kayyagari@apache.org>
To: Apache Directory Developers List <dev@directory.apache.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

 you can call kdcServer.setEncryptionTypes() (with an array or set of
EncryptionTypeS)
 note that, this method should be called from a non-static method
(typically from the setup method or the one having @Before annotation)
 calling it from static method might likely result in a null pointer except=
ion.

 Let me know if you have any issues

HTH
On Sun, Jan 15, 2012 at 3:04 AM, Aleksander Adamowski
<apache-directory@olo.org.pl> wrote:
> Hi!
>
> While working on my experimental KrbLDAP implementation (see the
> thread on MIT krbdev list:
> http://mailman.mit.edu/pipermail/krbdev/2012-January/010641.html),
> I've discovered that KdcServer by default supports a very limited set
> of encryption types consisting only of des-cbc-md5.
>
> MIT's libkrb5, on the other hand, by default requires one of 4
> enctypes, which doesn't include the ApacheDS's default:
> aes256-cts-hmac-sha1-96 (18),
> aes128-cts-hmac-sha1-96 (17),
> des3-cbc-sha1-kd (16),
> rc4-hmac (23)
>
> Is this choice made on purpose?
>
> In my experimental integration test, I'm creating the KdcServer using
> the @CreateKdcServer annotation:
> https://github.com/aadamowski/apacheds-krbldap-test/blob/master/src/test/=
java/pl/org/olo/krbldap/apacheds/test/KrbLdapIntegrationTest.java
>
> What's the best way to configure it to handle enctypes compatible with
> MIT libkrb5?
>
>
> --
> Best Regards,
> =A0 Aleksander Adamowski
> =A0 http://olo.org.pl


--=20
Kiran Ayyagari