Regarding AUTH_CRAP and NTLMv2

[Volker Lendecke]

On Mon, Jan 17, 2011 at 06:41:20PM +0530, Narendra Kumar S.S wrote:
>     One final clarification.
>     I am sending the AUTH_CRAP from my own code to winbindd and winbindd
> sends it to DC/AD.
>     Now the server has the capability to use the NTLMv2 response to find out
> the original user.
>     To verify the authenticity, it has to know who is sending the NTLMv2 (in
> this case, my code is sending it thru winbindd).
>     I am filling up the AUTH_CRAP with the same information that I received
> from server and client.
>     So, how does the DC/AD get the serverPrincipalName to verify with the
> information that it got in the NTLMv2 response?

It would probably do an LDAP search in the right domain with
"samaccountname=<username>" as a filter. It would then use
the DN of the object that results from this search to find
the rest of the attributes. You might want to contact
Microsoft for questions about this implemented.

With best regards,

Volker Lendecke

-- 
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: +49-551-370000-0, fax: +49-551-370000-9
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen