[OpenAFS] gssklogd access from windows

Douglas E. Engert deengert@anl.gov
Thu, 04 Sep 2003 14:27:53 -0500


The problems have to do with how the client determines the realm of the 
gssklog server. 

The gssklog gives the MS SSPI or GSSAPI the "gssklog@elm.cs.ttu.edu" 
( The "@" is a GSSAPI thing, not the realm seperator. Its a host based service.) 

The MIT client code will derive a realm name using DNS or the krb5.conf 
[domain_realm] mapping or assume the realm is the DNS domain in uppercase as 
CS.TTTU.EDU.  In this case it will then ask the client's KDC for a cross realm tgt,
and then ask the server's realm for a service ticket. (Tihs is the case that
worked for you below.)      

The SSPI does not have that client mapping  but will ask the client's KDC for a 
ticket for gssklog/elm.cs.ttu.edu and let the KDC determine the realm. If the KDC 
is a W2K domain and the server is in the same forest, the client's KDC can return 
a refferal to the client thus getting the cross realm tgt and service tickets. 

But if the Client's KDC is a W2K domain and the server's is MIT KDC,
the W2K does not know what realm the server is in, and thus fails to return
a ticket.  

There are two ways to solve this. 

 o The SSPI can actually allow the client to specify the realm,
   using some mapping of its own.  host@realm would be passed in
   I don't have this in the gssklog, but could add one, for example 
   if the initial attempt failed, try the domain name as the realm, or use DNS etc.   
   
 o Add a gssklog/elm.cs.ttu.edu@TTU.EDU to the client's KDC. 
   and have the gssklogd accept either. (This is what we do,
   but it takes a mod to the server's gssapi lib to aceppt either. 

I will look into the mapping. 

Chris McClimans wrote:
> 
> Here are some gssklog attempts from a windows box that is part of the
> TTU.EDU realm/domain.
> The afs cell is cs.ttu.edu in realm CS.TTU.EDU
> There is a one way trust where users in TTU.EDU can get
> krbtgt/CS.TTU.EDU but not the other way around.
> 
> I think the problem here is that the tickets retrieved from MIT and MS
> differ somewhat, but in what manner I am unsure.
> Any comments or suggestions are welcome.
> 
> ## Attempt to use gssklog using ms credential cache. (this would be the
> prefered way)
> ## I have logged into the computer using the normal GINA as
> cmcclima@TTU.EDU
> 
> C:\gssklog>klist tickets
> 
> Cached Tickets: (5)
> 
>     Server: krbtgt/TTU.EDU@TTU.EDU
>        KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
>        End Time: 9/4/2003 22:45:16
>        Renew Time: 9/11/2003 12:45:16
> 
>     Server: krbtgt/TTU.EDU@TTU.EDU
>        KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
>        End Time: 9/4/2003 22:45:16
>        Renew Time: 9/11/2003 12:45:16
> 
>     Server: CERBERUS$@TTU.EDU
>        KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
>        End Time: 9/4/2003 22:45:16
>        Renew Time: 9/11/2003 12:45:16
> 
>     Server: ldap/stheno.ttu.edu/ttu.edu@TTU.EDU
>        KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
>        End Time: 9/4/2003 22:45:16
>        Renew Time: 9/11/2003 12:45:16
> 
>     Server: STHENO$@TTU.EDU
>        KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
>        End Time: 9/4/2003 22:45:16
>        Renew Time: 9/11/2003 12:45:16
> 
> C:\gssklog>gssklog.exe -ms
> SSPI-error init_sec_context failed: major:80090303 minor:0012f200
> The specified target is unknown or unreachable

This is the SSPI saying it can not find the target principal in 
its Domain and can not sned a refferal. 

i.e. the client is asking TTU.EDU for gssklog/elm.cs.ttu.edu@TTU.EDU



> 
> Problem 2 with server elm.cs.ttu.edu, trying next
> SSPI-error init_sec_context failed: major:80090303 minor:0012f1f0
> The specified target is unknown or unreachable
> 
> Problem 2 with server oak.cs.ttu.edu
> Failed code = 2
> 
> ## Attempt to use gssklog via MIT (converting MS credentials to MIT
> cache)
> ## I have logged into the computer via normal GINA as cmcclima@TTU.EDU
> ## however this time klist/ kinit / ms2mit etc are all the MIT versions.
> 
> C:\Documents and Settings\cmcclima\Desktop\gssklog-mit> klist
> klist: No credentials cache found (ticket cache API:krb5cc)
> 
> C:\Documents and Settings\cmcclima\Desktop\gssklog-mit>ms2mit
> 
> C:\Documents and Settings\cmcclima\Desktop\gssklog-mit>klist
> Ticket cache: API:krb5cc
> Default principal: cmcclima@TTU.EDU
> 
> Valid starting     Expires            Service principal
> 09/04/03 12:45:16  09/04/03 22:45:16  krbtgt/TTU.EDU@TTU.EDU
>          renew until 09/11/03 12:45:16
> 
> C:\Documents and Settings\cmcclima\Desktop\gssklog-mit>gssklog
> GSS-error init_sec_context failed: major:000d0000 minor:00000000
> Miscellaneous failure
> No error
> Problem 2 with server elm.cs.ttu.edu, trying next
> GSS-error init_sec_context failed: major:000d0000 minor:00000000
> Miscellaneous failure
> No error
> Problem 2 with server oak.cs.ttu.edu
> Failed code = 2
> 
> C:\Documents and Settings\cmcclima\Desktop\gssklog-mit>gssklog -ms
> SSPI-error init_sec_context failed: major:80090303 minor:0012f200
> The specified target is unknown or unreachable
> 
> Problem 2 with server elm.cs.ttu.edu, trying next
> SSPI-error init_sec_context failed: major:80090303 minor:0012f1f0
> The specified target is unknown or unreachable
> 
> Problem 2 with server oak.cs.ttu.edu
> Failed code = 2
> 
> ## Attempt to use gssklog via MIT only, starting with an empty
> credential cache
> ## This is the only method that appears to work (and seems to prove
> that the servers are
> ## configured correctly.) What might I have configured wrong in the
> above attempts?
> 
> C:\Documents and Settings\cmcclima\Desktop\gssklog-mit>klist
> klist: No credentials cache found (ticket cache API:krb5cc)
> 
> C:\Documents and Settings\cmcclima\Desktop\gssklog-mit>kinit
> cmcclima@TTU.EDU
> Password for cmcclima@TTU.EDU:
> 
> C:\Documents and Settings\cmcclima\Desktop\gssklog-mit>klist
> Ticket cache: API:krb5cc
> Default principal: cmcclima@TTU.EDU
> 
> Valid starting     Expires            Service principal
> 09/04/03 12:49:26  09/04/03 22:49:26  krbtgt/TTU.EDU@TTU.EDU
> 
> C:\Documents and Settings\cmcclima\Desktop\gssklog-mit>gssklog
> 
> C:\Documents and Settings\cmcclima\Desktop\gssklog-mit>klist
> Ticket cache: API:krb5cc
> Default principal: cmcclima@TTU.EDU
> 
> Valid starting     Expires            Service principal
> 09/04/03 12:49:26  09/04/03 22:49:26  krbtgt/TTU.EDU@TTU.EDU
> 09/04/03 12:49:26  09/04/03 22:49:26  krbtgt/CS.TTU.EDU@TTU.EDU
> 09/04/03 12:49:35  09/04/03 22:49:26  gssklog/elm.cs.ttu.edu@CS.TTU.EDU
> 
> C:\Documents and Settings\cmcclima\Desktop\gssklog-mit>tokens
> 
> Tokens held by the Cache Manager:
> 
> User cmcclima's tokens for afs@cs.ttu.edu [Expires Sep 04 22:49]
>     --End of list --
> 
> _______________________________________________
> OpenAFS-info mailing list
> OpenAFS-info@openafs.org
> https://lists.openafs.org/mailman/listinfo/openafs-info

-- 

 Douglas E. Engert  <DEEngert@anl.gov>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444