KVNO of trusts
|
View:
New views
13 Messages
—
Rating Filter:
Alert me
|
 |
KVNO of trusts
by Andrew Bartlett
::
Rate this Message:
How do I determine what Key Version Number (kvno) to assign to trusted domain entities in the KDC?
For normal users, we have msDS-KeyVersionNumber, but as per our previous discussions, trusts do not need cn=user type objects for interoperability (I point I dispute, but regardless). So, what is the source of the key version number for these principals? (Is it the 'for NETLOGON use' version number in the trustAuthIncoming and trustAuthOutgoing attributes, for example?) Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. _______________________________________________ cifs-protocol mailing list cifs-protocol@... https://lists.samba.org/mailman/listinfo/cifs-protocol |
|
|
RE: KVNO of trusts
by Bill Wesse
::
Rate this Message:
|
|
|
RE: KVNO of trusts
by John Dunning-5
::
Rate this Message:
|
|
|
RE: KVNO of trusts
by John Dunning-5
::
Rate this Message:
|
|
|
RE: KVNO of trusts
by Andrew Bartlett
::
Rate this Message:
On Thu, 2008-10-02 at 09:17 -0700, John Dunning wrote:
> Hello Andrew, > > We have concluded our investigation regarding this issue. > > Question: "How do I determine what Key Version Number (kvno) to assign to trusted domain entities in the KDC?" > > Answer: > The key version number of the trust password for a trust object is set > by making a LsarSetTrustedDomainInfoByName ([MS-LSAD] section > 3.1.4.7.6) request when the trust is created. It is incremented by 1 > each time the trust password is changed. The key version number can be > determined at any time by making an LsarQueryTrustedDomainInfoByName > request or parsing the trustAuthInfoIncoming/trustAuthInfoOutgoing > attributes using the information provided in MS-ADTS section > 7.1.6.9.1 and looking for an LSAPR_AUTH_INFORMATION structure with > AuthType equal to TRUST_AUTH_TYPE_VERSION (3). structure, when it initially calls CreateTrustedDomainEx? (I think it is -1) > A change will be made to the [MS-ADA2]document section 2.235 Attribute msDS-KeyVersionNumber which will be similar to the following: > > 2.235 Attribute msDS-KeyVersionNumber > For a given user, computer or built-in account, this attribute > specifies the Kerberos version number of the current key for that > account. The Kerberos key version number for trusts is stored in the > trusted domain object (TDO) whose object class is trustedDomain Can i suggest a slight rewording: For a trusted domain (objectClass trustedDomain), the Kerberos key version number is stored in the trusted domain object (TDO), embedded in the trustAuthIncoming and trustAuthOutgoing attributes. Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com _______________________________________________ cifs-protocol mailing list cifs-protocol@... https://lists.samba.org/mailman/listinfo/cifs-protocol |
|
|
RE: KVNO of trusts
by John Dunning-5
::
Rate this Message:
|
|
|
RE: KVNO of trusts
by Andrew Bartlett
::
Rate this Message:
On Wed, 2008-10-08 at 09:31 -0700, John Dunning wrote:
> Hello Andrew, > Thank you for your rewording suggestion. I have passed this information on to my Product Team. > > I also have an answer to your question: > > "What is the kvno if the client does not provide one in that structure, when it initially calls CreateTrustedDomainEx? (I think it is -1)?" > > Answer: > > If TRUST_AUTH_TYPE_VERSION is missing, the key version # for that > trust key in Kerberos protocol is not filled. In such a case, the > Windows Kerberos will ignore the missing key version # field. > The key version (and the TRUST_AUTH_TYPE_VERSION field) is always > present in Microsoft implementations to maximize interoperability. CreateTrustedDomainEx2 call I got from Windows 2008. That is why I asked. Perhaps I'm (as a server) meant to add this to the record? If so, what information should I use to do so? Also, while this element is indeed optional according to the ASN.1, it seemed to be filled in by windows in this case. I'll try to reproduce the setup we had at the IO lab this week, and give you some more concrete details. Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com _______________________________________________ cifs-protocol mailing list cifs-protocol@... https://lists.samba.org/mailman/listinfo/cifs-protocol |
|
|
RE: KVNO of trusts
by John Dunning-5
::
Rate this Message:
|
|
|
RE: KVNO of trusts
by Andrew Bartlett
::
Rate this Message:
On Fri, 2008-10-24 at 12:53 -0700, John Dunning wrote:
> Hello Andrew, > I am sorry for the delayed response but I was out of the office the first part of the week. > > Were you still going to provide more concrete details or did you want me to pursue this with the information I have? I've not had a chance to reproduce it yet (in terms of the KDC <-> KDC interaction that showed -1 in use). The original blob without the in the CreateTrusteDomainEx is in my request about the parsing of that structure. Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. _______________________________________________ cifs-protocol mailing list cifs-protocol@... https://lists.samba.org/mailman/listinfo/cifs-protocol |
|
|
RE: KVNO of trusts
by John Dunning-5
::
Rate this Message:
|
|
|
RE: KVNO of trusts
by Andrew Bartlett
::
Rate this Message:
|
signature.asc (196 bytes)