Client side matching call for gsskrb5_get_subkey()

[Andrew Bartlett]

I've been working to get Vista to join Samba4 as a domain member, and in
some instances, it fails due to invalid smb signing.

The problem was that we used the wrong call into Heimdal to get the
session key.  I'm sure I was told it was the wrong thing many moons ago,
but we were calling gsskrb5_get_initiator_subkey().

This worked well, and matched previous Microsoft clients and servers,
and Samba itself.

However, while changing this call to gsskrb5_get_subkey() works for the
server (both for smb signing, and for SAMR password sets - on SAMR we
must truncate to 16 bytes), it gives a different key in the Samba4
client.

What is the matching call we should issue on the Samba client, to get at
the same key?  (I'm presuming the problem is the acceptor subkey).

Thanks,

Andrew Bartlett
-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.                  http://redhat.com

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba-technical/attachments/20080722/a9b0e68f/attachment.bin