forest trust

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|  
Report Content as Inappropriate

forest trust

Samba - General mailing list
samba-4.6.5

after set transitive forest trust with win2008R2
problems with processing GPO
some logs in samba show problems with kerberos constrained delegation

Kerberos: TGS-REQ W7-WRK1$@SFB.TEST.SIP.OFFICE.GL from ipv4:
192.168.100.22:50515 for w7-wrk1$\@
[hidden email] [canonicalize,
request-anonymous, renewable, forwardable]
Kerberos: Bad request for constrained delegation
Kerberos: constrained delegation from W7-WRK1$@SFB.TEST.SIP.OFFICE.GL
(w7-wrk1$\@[hidden email]) as W7-WRK1$@
SFB.TEST.SIP.OFFICE.GL to w7-wrk1$\@
[hidden email] not allowed
Kerberos: Failed building TGS-REP to ipv4:192.168.100.22:50515


problem with check constrained delegation
in /kdc/krb5tgs.c
function check_constrained_delegation

if(!krb5_realm_compare(context, client->entry.principal,
server->entry.principal)) {
ret = KRB5KDC_ERR_BADOPTION;
kdc_log(context, config, 0,
   "Bad request for constrained delegation");
return ret;
}

this function just strcmp of realms char*

no idea why it failed
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba
Loading...