Skip Menu |
 

History Show all quoted text — Show full headers
# Mon Jan 19 16:48:05 2004 jaltman (Jeffrey Altman) - Ticket created
Subject: KfW vs Windows 2003 Server
Download (untitled) / with headers
text/plain 805B
In the process of testing KfW 2.6 Beta 2 on Windows 2003, it has been
noticed that
due to a change in the MS LSA behavior, when reading a TGT from the LSA to
insert into the MIT ccache (ms2mit.exe) that the session key is no
longer provided. This makes the TGT useless for applications which are
expecting to use the TGT to
obtain additional tickets.
There is a new registry key which can be set which will restore the
behavior used in
Windows 2000 and XP.
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
AllowTGTSessionKey = 0x1 (DWORD)

The question is: Should the Kerberos for Windows installer set this
parameter
as part of the installation procedure on Windows 20003?
If it is not set, should ms2mit.exe and Leash generate an error instead of
performing the ticket importation?
# Mon Jan 19 16:48:12 2004 jaltman (Jeffrey Altman) - Taken
# Tue Jan 20 13:26:33 2004 jaltman (Jeffrey Altman) - Status changed from 'new' to 'open'
# Tue Jan 20 13:26:33 2004 jaltman (Jeffrey Altman) - Correspondence added
Download (untitled) / with headers
text/plain 362B
Feedback on krbdev from Doug and Paul indicate that the registry setting
should be set by the current installer. This will be done for 2.6 Beta 3.

However, we should in the future consider the possibility of making the
default ccache "MSLSA:" when the windows logon session is authenticated
with "kerberos lsa". For this reason I am leaving this issue open.
# Sat Sep 11 11:27:47 2004 jaltman (Jeffrey Altman) - Status changed from 'open' to 'resolved'
# Sat Sep 11 11:27:48 2004 jaltman (Jeffrey Altman) - Correspondence added
Download (untitled) / with headers
text/plain 404B
The key for non-Server versions of Windows is

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos
AllowTGTSessionKey = 0x1 (DWORD)

This is set by the KFW installers.

Although we are not currently setting the MSLSA as the default cache I
am going to close this ticket at this point because significant progress
has been made to improve the interoperability of the LSA cache. See
ticket 2705.
# Sat Sep 11 11:27:59 2004 jaltman (Jeffrey Altman) - Ticket 2136 RefersTo ticket 2705.