Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Date: Fri, 28 Feb 2014 10:21:19 +0000 (UTC)
From: "Kiran Ayyagari (JIRA)" <jira@apache.org>
To: dev@directory.apache.org
Message-ID: <JIRA.12697346.1393413877654.123602.1393582879940@arcas>
In-Reply-To: <JIRA.12697346.1393413877654@arcas>
References: <JIRA.12697346.1393413877654@arcas>
Subject: [jira] [Commented] (DIRKRB-100) Active Directory support for
 KdcConnection
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/DIRKRB-100?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13915634#comment-13915634 ] 

Kiran Ayyagari commented on DIRKRB-100:
---------------------------------------

bq. Seems like KdcConnection chooses the first available configured enc_type...
yes, this is definitely a bug, otoh, I was able to decrypt the EncKdcRepPart of received AS_REP (present in the latest pcap file containing KDC interaction using des-cbc-md5 etype).
This clearly shows that the RC4 support in KdcConnection is buggy. 

> Active Directory support for KdcConnection
> ------------------------------------------
>
>                 Key: DIRKRB-100
>                 URL: https://issues.apache.org/jira/browse/DIRKRB-100
>             Project: Directory Kerberos
>          Issue Type: Improvement
>            Reporter: Eirik Bjorsnos
>            Assignee: Emmanuel Lecharny
>
> I'm testing KdcConnection.getTgt() with Microsoft Active Directory.
> My first test failed with AD responding with first saying KRB5KRB_ERR_PREAUTH_REQUIRED (expected), then KRB5KRB_ERR_PREAUTH_FAILED (not expected).
> Since PREAUTH_FAILED is what you'll also get if your password is wrong, I enabled "Do not use pre authentication" for the account being tested and verified via kinit on OS X that no pre authentication was sent there.
> When testing getTgt with no preauth, I now get the following exception:
> Exception in thread "main" org.apache.directory.server.kerberos.changepwd.exceptions.ChangePasswordException: Request failed due to being malformed.
> 	at org.apache.directory.server.kerberos.protocol.codec.KerberosDecoder.decodeEncTgsRepPart(KerberosDecoder.java:684)
> 	at org.apache.directory.kerberos.client.KdcConnection._getTgt(KdcConnection.java:329)
> 	at org.apache.directory.kerberos.client.KdcConnection.getTgt(KdcConnection.java:181)
> 	at org.apache.directory.kerberos.client.KdcConnection.getTgt(KdcConnection.java:145)


--
This message was sent by Atlassian JIRA
(v6.1.5#6160)