[cifs-protocol] RE: KVNO of trusts
abartlet at samba.org
Wed Oct 8 23:31:44 GMT 2008
On Wed, 2008-10-08 at 09:31 -0700, John Dunning wrote:
> Hello Andrew,
> Thank you for your rewording suggestion. I have passed this information on to my Product Team.
> I also have an answer to your question:
> "What is the kvno if the client does not provide one in that structure, when it initially calls CreateTrustedDomainEx? (I think it is -1)?"
> If TRUST_AUTH_TYPE_VERSION is missing, the key version # for that
> trust key in Kerberos protocol is not filled. In such a case, the
> Windows Kerberos will ignore the missing key version # field.
> The key version (and the TRUST_AUTH_TYPE_VERSION field) is always
> present in Microsoft implementations to maximize interoperability.
I didn't find the version in the blob attached to the
CreateTrustedDomainEx2 call I got from Windows 2008. That is why I
Perhaps I'm (as a server) meant to add this to the record? If so, what
information should I use to do so?
Also, while this element is indeed optional according to the ASN.1, it
seemed to be filled in by windows in this case.
I'll try to reproduce the setup we had at the IO lab this week, and give
you some more concrete details.
Authentication Developer, Samba Team http://samba.org
Samba Developer, Red Hat Inc. http://redhat.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/cifs-protocol/attachments/20081009/216e078b/attachment.bin
More information about the cifs-protocol