Return-Path: X-Original-To: apmail-directory-dev-archive@www.apache.org Delivered-To: apmail-directory-dev-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 2B1CBF135 for ; Wed, 10 Apr 2013 03:52:33 +0000 (UTC) Received: (qmail 80116 invoked by uid 500); 10 Apr 2013 03:52:33 -0000 Delivered-To: apmail-directory-dev-archive@directory.apache.org Received: (qmail 79844 invoked by uid 500); 10 Apr 2013 03:52:29 -0000 Mailing-List: contact dev-help@directory.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: "Apache Directory Developers List" Delivered-To: mailing list dev@directory.apache.org Received: (qmail 79521 invoked by uid 99); 10 Apr 2013 03:52:27 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 10 Apr 2013 03:52:27 +0000 X-ASF-Spam-Status: No, hits=1.5 required=5.0 tests=HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of ayyagarikiran@gmail.com designates 209.85.223.173 as permitted sender) Received: from [209.85.223.173] (HELO mail-ie0-f173.google.com) (209.85.223.173) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 10 Apr 2013 03:52:23 +0000 Received: by mail-ie0-f173.google.com with SMTP id 9so41532iec.32 for ; Tue, 09 Apr 2013 20:52:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:x-received:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:content-type; bh=g/YyFqXTZf0tl8+y1c7dVQ420+tnHld4l7SY4hUcXH4=; b=UAb/ukN64jW1/FCZIlCnP+RkAmnPTUjVDs7OqSnKCaCq0FoYqN5C33/KdCzPsDq5+I tSnC/VfdGrInDAxljVGCWvBCSV5lgNdeamp6xVLAuEGZsAeo5GiKtS86VgT1OqATUMt2 6hVrgC102HYcHCTRrqFB6WvGorXoPLKg+iRisDHx+VL+iEoZJRab3VWRZmwv+HbVgphv UoF83ykqNYs6s9iLCGP/8iFsWtWj9LylysUvTQwsZ3tcltkjGGcOn2GhDZdXZF6sC1qr Lts2s5DDI2IoepClScZsJYp07kODcuze1wYCd4ZufxVTb0DYmZ4olSgHGSR1H/p5Jr5W U6kA== MIME-Version: 1.0 X-Received: by 10.50.135.8 with SMTP id po8mr269253igb.41.1365565922813; Tue, 09 Apr 2013 20:52:02 -0700 (PDT) Sender: ayyagarikiran@gmail.com Received: by 10.231.121.5 with HTTP; Tue, 9 Apr 2013 20:52:02 -0700 (PDT) In-Reply-To: <7D664BE6CF058A4CB1A06984A7AA678F18003661B1@SM-CALA-VXMB06A.swna.wdpr.disney.com> References: <7D664BE6CF058A4CB1A06984A7AA678F180012B0B4@SM-CALA-VXMB06A.swna.wdpr.disney.com> <515FB38C.2030600@gmail.com> <7D664BE6CF058A4CB1A06984A7AA678F180012B17F@SM-CALA-VXMB06A.swna.wdpr.disney.com> <7D664BE6CF058A4CB1A06984A7AA678F180012B182@SM-CALA-VXMB06A.swna.wdpr.disney.com> <516257D2.4000703@gmail.com> <7D664BE6CF058A4CB1A06984A7AA678F180012B37F@SM-CALA-VXMB06A.swna.wdpr.disney.com> <7D664BE6CF058A4CB1A06984A7AA678F180012B435@SM-CALA-VXMB06A.swna.wdpr.disney.com> <51630065.3010801@gmail.com> <7D664BE6CF058A4CB1A06984A7AA678F180012B4B8@SM-CALA-VXMB06A.swna.wdpr.disney.com> <7D664BE6CF058A4CB1A06984A7AA678F180012B8F0@SM-CALA-VXMB06A.swna.wdpr.disney.com> <51639AFA.4030906@gmail.com> <7D664BE6CF058A4CB1A06984A7AA678F180012BC34@SM-CALA-VXMB06A.swna.wdpr.disney.com> <516442E4.2040806@gmail.com> <7D664BE6CF058A4CB1A06984A7AA678F180012BCA4@SM-CALA-VXMB06A.swna.wdpr.disney.com> <7D664BE6CF058A4CB1A06984A7AA678F18003661B1@SM-CALA-VXMB06A.swna.wdpr.disney.com> Date: Wed, 10 Apr 2013 09:22:02 +0530 X-Google-Sender-Auth: yMPvp2gzTk2bKXEx0OwHrAaJbNc Message-ID: Subject: Re: kinit failed on - Integrity check on decrypted field failed From: Kiran Ayyagari To: Apache Directory Developers List Content-Type: multipart/alternative; boundary=e89a8f83ab13bf2ca804d9f99701 X-Virus-Checked: Checked by ClamAV on apache.org --e89a8f83ab13bf2ca804d9f99701 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On Wed, Apr 10, 2013 at 2:43 AM, Wu, James C. wrote= : > Hi, > > I came across this page which describes how Kerberos key are derived from > the passwords of an entry. > http://directory.apache.org/apacheds/kerberos-ug/1.1.3-keys.html > > It mentioned that the Kerberos keys are basically a hashed value of the > passwords with the salt be the realm name. I am wondering how does the > kinit program know the salt for the Kerberos key? Is it passed from > apacheds? I did not see just like you mentioned above, realm name is used as salt and kinit knows the realm name > something like that mentioned in the log output. > > I guess the kinit has to know both the encryption type and the salt in > order to reproduce the Kerberos encryption key so that it can decrypt > message from apacheds. Am I right? > > Regards, > > James > > -----Original Message----- > From: dev-return-42835-James.C.Wu=3Ddisney.com@directory.apache.org [mail= to: > dev-return-42835-James.C.Wu=3Ddisney.com@directory.apache.org] On Behalf = Of > Wu, James C. > Sent: Tuesday, April 09, 2013 9:49 AM > To: Apache Directory Developers List > Subject: RE: kinit failed on - Integrity check on decrypted field failed > > I am very sure of that. I just deleted the hnelson entry and recreate it > using the ldapadd command. The hnelson.ldif file is as follows: > > dn: uid=3Dhnelson,ou=3Dusers,dc=3Dexample,dc=3Dcom > objectclass: top > objectclass: person > objectclass: inetOrgPerson > objectclass: krb5Principal > objectclass: krb5KDCEntry > cn: Horatio Nelson > sn: Nelson > uid: hnelson > userpassword: secret01 > krb5PrincipalName: hnelson@EXAMPLE.COM > > > The ldap command I used to add the entry is > > ldapadd -x -W -D "uid=3Dadmin,ou=3Dsystem" -f hnelson.ldif -H > ldap://localhost:10389 > > When I do a ldapsearch, I saw the hnelson entry as follows > > # hnelson, users, example.com > dn: uid=3Dhnelson,ou=3Dusers,dc=3Dexample,dc=3Dcom > uid: hnelson > userpassword:: > e1NTSEF9WlBoT0RueU1sL3FmSVZ1K0tIaHloQU5XN2Z5RWF5cGZSeFMvZ1E9PQ=3D > =3D > objectclass: organizationalPerson > objectclass: krb5Principal > objectclass: person > objectclass: krb5KDCEntry > objectclass: inetOrgPerson > objectclass: top > cn: Horatio Nelson > sn: Nelson > krb5KeyVersionNumber: 0 > krb5Key:: MBmgAwIBEaESBBBEoHCxETKoK5EHlTW1kdUP > krb5Key:: MBGgAwIBA6EKBAhFVAF2buW19A=3D=3D > krb5Key:: MCGgAwIBEKEaBBiDZDj0L9XH7BrCJfJYHBBzJTHHUdaFdSk=3D > krb5Key:: MBmgAwIBF6ESBBCIi91Z4Xn3gVQeWmSirA7o > krb5Key:: MCmgAwIBEqEiBCDY8jXKWlxWMGCcyKRIIVOQgjde+LItumdkwKUy/PXPKw=3D= =3D > krb5PrincipalName: hnelson@EXAMPLE.COM > > > > -----Original Message----- > From: Emmanuel L=E9charny [mailto:elecharny@gmail.com] > Sent: Tuesday, April 09, 2013 9:34 AM > To: Apache Directory Developers List > Subject: Re: kinit failed on - Integrity check on decrypted field failed > > Le 4/9/13 6:24 PM, Wu, James C. a =E9crit : > > I will do it. The log output are also attached below in this email. I= f > anyone can take a quick look at it, I would really appreciate. -- > james > > Just looked at the logs, so far, it seems that everyting goes find, up to > a point you get the error. > > Are you *sure* that the password is the one stored in the entry ? > > > -- > Regards, > Cordialement, > Emmanuel L=E9charny > www.iktek.com > > --=20 Kiran Ayyagari http://keydap.com --e89a8f83ab13bf2ca804d9f99701 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable



On Wed, Apr 10, 2013 at 2:43 AM, Wu, James C. <= ;James.C.Wu@disn= ey.com> wrote:
Hi,

I came across this page which describes how Kerberos key are derived from t= he passwords of an entry.
http://directory.apache.org/apacheds/kerberos-ug/1.1.3-= keys.html

It mentioned that the Kerberos keys are basically a hashed value of the pas= swords with the salt be the realm name. I am wondering how does the kinit p= rogram know the salt for the Kerberos key? Is it passed from apacheds? I di= d not see
just like you mentioned above, realm name is used as salt and kinit kn= ows the realm name
something like t= hat mentioned in the log output.

I guess the kinit has to know both the encryption type and the salt in orde= r to reproduce the Kerberos encryption key so that it can decrypt message f= rom apacheds. Am I right?

Regards,

James

-----Original Message-----
From: dev-return-42835-James.C.Wu=3Ddisney.com@directory.apache.org [mailto:dev-return-42835-James.C.Wu=3Ddisney.com@directory.apache.org] = On Behalf Of Wu, James C.
Sent: Tuesday, April 09, 2013 9:49 AM
To: Apache Directory Developers List
Subject: RE: kinit failed on = - Integrity check on decrypted field failed

I am very sure of that. I just deleted the hnelson entry and recreate it us= ing the ldapadd command. The hnelson.ldif file is as follows:

=A0 dn: uid=3Dhnelson,ou=3Dusers,dc=3Dexample,dc=3Dcom
=A0 objectclass: top
=A0 objectclass: person
=A0 objectclass: inetOrgPerson
=A0 objectclass: krb5Principal
=A0 objectclass: krb5KDCEntry
=A0 cn: Horatio Nelson
=A0 sn: Nelson
=A0 uid: hnelson
=A0 userpassword: secret01
=A0 krb5PrincipalName: hnelson@EXAMP= LE.COM


The ldap command I used to add the entry is

=A0 ldapadd -x -W -D "uid=3Dadmin,ou=3Dsystem" -f hnelson.ldif -H= ldap://localhost:10389

When I do a ldapsearch, I saw the hnelson entry as follows

=A0 # hnelson, users, exam= ple.com
=A0 dn: uid=3Dhnelson,ou=3Dusers,dc=3Dexample,dc=3Dcom
=A0 uid: hnelson
=A0 userpassword:: e1NTSEF9WlBoT0RueU1sL3FmSVZ1K0tIaHloQU5XN2Z5RWF5cGZSeFMv= Z1E9PQ=3D
=A0 =A0=3D
=A0 objectclass: organizationalPerson
=A0 objectclass: krb5Principal
=A0 objectclass: person
=A0 objectclass: krb5KDCEntry
=A0 objectclass: inetOrgPerson
=A0 objectclass: top
=A0 cn: Horatio Nelson
=A0 sn: Nelson
=A0 krb5KeyVersionNumber: 0
=A0 krb5Key:: MBmgAwIBEaESBBBEoHCxETKoK5EHlTW1kdUP
=A0 krb5Key:: MBGgAwIBA6EKBAhFVAF2buW19A=3D=3D
=A0 krb5Key:: MCGgAwIBEKEaBBiDZDj0L9XH7BrCJfJYHBBzJTHHUdaFdSk=3D
=A0 krb5Key:: MBmgAwIBF6ESBBCIi91Z4Xn3gVQeWmSirA7o
=A0 krb5Key:: MCmgAwIBEqEiBCDY8jXKWlxWMGCcyKRIIVOQgjde+LItumdkwKUy/PXPKw=3D= =3D
=A0 krb5PrincipalName: hnelson@EXAMP= LE.COM



-----Original Message-----
From: Emmanuel L=E9charny [mailto:el= echarny@gmail.com]
Sent: Tuesday, April 09, 2013 9:34 AM
To: Apache Directory Developers List
Subject: Re: kinit failed on - Integrity check on decrypted field failed
Le 4/9/13 6:24 PM, Wu, James C. a =E9crit :
> I will do it. =A0The log output are also attached below in this email.= =A0If anyone can take a quick look at it, I would really appreciate. =A0 = =A0 =A0-- =A0james

Just looked at the logs, so far, it seems that everyting goes find, up to a= point you get the error.

Are you *sure* that the password is the one stored in the entry ?


--
Regards,
Cordialement,
Emmanuel L=E9charny
www.iktek.com




--
Kiran Ayyag= ari
http://keydap.com
--e89a8f83ab13bf2ca804d9f99701--