Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: pass (nike.apache.org: domain of akarasulu@gmail.com designates
 72.14.220.156 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :content-type;
        b=cDyRhCpNqur6a9QrLpaZ5cgTjIdfbz7N4VpjQyDlg5L+INan6hTL33PyZ7cyV7tGkH
         lrCIPPeCUerhWT7uDyCHOgZGkv5eS9Avuz1vC1ZL2HgOidOIXpqkarOGewL7O85mwN7p
         zmI8HfBjnXwqSCiooY2fNWX4KortIx8PQZsXE=
MIME-Version: 1.0
In-Reply-To: <k2tecbbfeda1004211708xa9f16143y631125222a74bc89@mail.gmail.com>
References: <j2qecbbfeda1004211333j85fda795gcc498c7ea5555d11@mail.gmail.com>
	 <4BCF6EE0.6070503@apache.org>
	 <k2tecbbfeda1004211708xa9f16143y631125222a74bc89@mail.gmail.com>
Date: Thu, 22 Apr 2010 08:42:02 +0300
Message-ID: <g2oa32f6b021004212242ja7e3b11h6d42eec4a8c5df22@mail.gmail.com>
Subject: Re: Kerberos Can't Find Users
From: Alex Karasulu <akarasulu@gmail.com>
To: users@directory.apache.org
Content-Type: multipart/alternative; boundary=001485f5b18827cabe0484ccc57b

--001485f5b18827cabe0484ccc57b
Content-Type: text/plain; charset=ISO-8859-1

On Thu, Apr 22, 2010 at 3:08 AM, Andrew Wiley <debio264@gmail.com> wrote:

> On Wed, Apr 21, 2010 at 4:32 PM, Stefan Seelmann <seelmann@apache.org
> >wrote:
> >
> > Please check the Kerberos configuration example [1]. You need to make
> > the same settings when you configure the KDC programatically (I myself
> > never tried this but want to do so at the weekend).
> >
> > Did you add the KeyDerivationInterceptor to the interceptor chain before
> > adding your entry?
> >
>
> That was the issue, it seems. For some reason, adding a
> KeyDerivationInterceptor to service.getInterceptors() doesn't work, but
> adding one to service.getInterceptorChain() works.
>

This is because when you get the interceptor list from the service you're
getting a cloned copy where your changes are not reflected in the actual
list maintained by the service. The chain however is mutable.  This reflects
some shortcomings in this API and should be fixed so users do not have this
problem again.


> However, how should I be setting passwords in my program? When I create
> users, I've been trying to just do this:
> entry.add("userPassword", password);
> But this results in a NPE when the KeyDerivationInterceptor tries to read
> the password from the new entry.
> If I add an entry manually though the Directory Studio, I now get this
> error
> from kinit:
> kinit: KDC has no support for padata type while getting initial credentials
> and this from ADS:
> 358279 [NioDatagramAcceptor-3] WARN
> org.apache.directory.server.kerberos.protocol.KerberosProtocolHandler  -
> KDC
> has no support for padata type (16)
>
> and... what does that mean? I'll be looking around for it, but I've never
> seen the term padata before, and I've read a good bit on Kerberos.
>
>
You have a stack trace?


> Thanks,
> Andrew Wiley
>


-- 
Alex Karasulu
My Blog :: http://www.jroller.com/akarasulu/
Apache Directory Server :: http://directory.apache.org
Apache MINA :: http://mina.apache.org
To set up a meeting with me: http://tungle.me/AlexKarasulu

--001485f5b18827cabe0484ccc57b--