forest trust

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

forest trust

Samba - General mailing list

after set transitive forest trust with win2008R2
problems with processing GPO
some logs in samba show problems with kerberos constrained delegation

Kerberos: TGS-REQ W7-WRK1$@SFB.TEST.SIP.OFFICE.GL from ipv4: for w7-wrk1$\@
[hidden email] [canonicalize,
request-anonymous, renewable, forwardable]
Kerberos: Bad request for constrained delegation
Kerberos: constrained delegation from W7-WRK1$@SFB.TEST.SIP.OFFICE.GL
(w7-wrk1$\@[hidden email]) as W7-WRK1$@
SFB.TEST.SIP.OFFICE.GL to w7-wrk1$\@
[hidden email] not allowed
Kerberos: Failed building TGS-REP to ipv4:

problem with check constrained delegation
in /kdc/krb5tgs.c
function check_constrained_delegation

if(!krb5_realm_compare(context, client->entry.principal,
server->entry.principal)) {
kdc_log(context, config, 0,
   "Bad request for constrained delegation");
return ret;

this function just strcmp of realms char*

no idea why it failed
To unsubscribe from this list go to the following URL and read the