[cifs-protocol] RE: KVNO of trusts

[Andrew Bartlett]

On Wed, 2008-10-08 at 09:31 -0700, John Dunning wrote:
> Hello Andrew,
>    Thank you for your rewording suggestion. I have passed this information on to my Product Team.
> 
> I also have an answer to your question:
> 
> "What is the kvno if the client does not provide one in that structure, when it initially calls CreateTrustedDomainEx?  (I think it is -1)?"
> 
> Answer:
> 
> If TRUST_AUTH_TYPE_VERSION  is missing, the key version # for that
> trust key in Kerberos protocol is not filled. In such a case, the
> Windows Kerberos will ignore the missing key version # field.
> The key version (and the TRUST_AUTH_TYPE_VERSION field) is always
> present in Microsoft implementations to maximize interoperability.

I didn't find the version in the blob attached to the
CreateTrustedDomainEx2 call I got from Windows 2008.  That is why I
asked. 

Perhaps I'm (as a server) meant to add this to the record?  If so, what
information should I use to do so?

Also, while this element is indeed optional according to the ASN.1, it
seemed to be filled in by windows in this case.  

I'll try to reproduce the setup we had at the IO lab this week, and give
you some more concrete details. 

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.                  http://redhat.com

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/cifs-protocol/attachments/20081009/216e078b/attachment.bin