Rocksolid Light

Welcome to RetroBBS

mail  files  register  newsreader  groups  login

Message-ID:  

21 May, 2024: Computers section is temporarily disabled for maintenance. It will take several days before it's back.


devel / comp.protocols.kerberos / Re: honoring the TRUSTED_FOR_DELEGATION KDC MS-SFU Kerberos Protocol Extensions flag?

SubjectAuthor
o Re: honoring the TRUSTED_FOR_DELEGATION KDC MS-SFU Kerberos Protocol Extensions Ken Hornstein

1
Re: honoring the TRUSTED_FOR_DELEGATION KDC MS-SFU Kerberos Protocol Extensions flag?

<mailman.99.1714523589.2322.kerberos@mit.edu>

  copy mid

https://www.rocksolidbbs.com/devel/article-flat.php?id=551&group=comp.protocols.kerberos#551

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder9.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.mailman.mit.edu!not-for-mail
From: kenh@cmf.nrl.navy.mil (Ken Hornstein)
Newsgroups: comp.protocols.kerberos
Subject: Re: honoring the TRUSTED_FOR_DELEGATION KDC MS-SFU Kerberos Protocol
Extensions flag?
Date: Tue, 30 Apr 2024 20:32:57 -0400
Organization: TNet Consulting
Lines: 30
Message-ID: <mailman.99.1714523589.2322.kerberos@mit.edu>
References: <CAEkxbZuz1h7Ef4N5nz3teb8vcTxTE6iBUZC+TYssUcayKHhXQQ@mail.gmail.com>
<202404152356.43FNu4Wj009470@hedwig.cmf.nrl.navy.mil>
<Zh3JEbB0IfDztgSQ@tamriel.snowman.net>
<CAEkxbZvn=3G3MVossM0aRC3pFd+JCX13ugUo6BwyKqaKtv--xg@mail.gmail.com>
<202404170130.43H1UpOg023445@hedwig.cmf.nrl.navy.mil>
<CAEkxbZupQObPrSC7PLvVV9+de8Pjj=d=dYRZWFvY3wMyUQPxMA@mail.gmail.com>
<202404301649.43UGnfNE028201@hedwig.cmf.nrl.navy.mil>
<992e2dea-dbd3-4f43-8b2a-7f4c8a6004c8@mit.edu>
<202405010033.4410X0uE000445@hedwig.cmf.nrl.navy.mil>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="mailman.mit.edu:18.7.21.50";
logging-data="12738"; mail-complaints-to="newsmaster@tnetconsulting.net"
To: kerberos@mit.edu
DKIM-Filter: OpenDKIM Filter v2.11.0 unknown-host (unknown-jobid)
Authentication-Results: mailman.mit.edu;
dkim=pass (1024-bit key, unprotected) header.d=mitprod.onmicrosoft.com
header.i=@mitprod.onmicrosoft.com header.a=rsa-sha256
header.s=selector2-mitprod-onmicrosoft-com header.b=pE7jqQlx;
dkim=pass (2048-bit key,
unprotected) header.d=nrl.navy.mil header.i=@nrl.navy.mil header.a=rsa-sha256
header.s=s2.dkim header.b=C4xl270s
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=bLK5t7WCqsqOtT1FtMRZFArQQY+ArdXqqX3quPgJ3bOgTyeA1OOvEY2XF1N8JjZOdnx5pss9YCqpljQYsgFHCdWVW6Ygbey1pdO9PFYQG75ko4di3d27TzbxR11XDhFKHXY6q3Vsb54vziEILgA/zUv67ixoLf+ED9JvMmXI3tUtWkOHkXt+4fSCReS593YdnFFJpe80PK0Np9k5js3mnkRRqvL29aFS8Ux5TcXrAvk7yeclxrPChgQ5CNOnit7RLAMzxL62vtm5aV9A62LwV2ea7tARQ4a0O4rodRT948Xtdu6aGWbewdBgJtsCA1UMRMHWiK7RVyrGY2Nkco3Iqg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=NcwtvS/iR9DBYmq0BaLGXdIa6nfeX+us4JKX1sw7hw4=;
b=C1w8p8kEhO0oHH/6kl0JJxp+gdsnDkGg8SREbhG3oRHdwKZ8k7d93jTawpSHZtarbveb15uy0VOHTVzNRlNQQ4ZDFvwKKI3IPwblSK2USqKN45LAgKvWnC6KuVJB9pqXaB40eR9WdtuSDcYvB2yxVcxXnlynFFXNcSCIf1Ju2ehWcb7igs9+VgZZ5m/mZU//YV93Sn5UzYHWuZjmYB8HuCAA1AvZ8eZFbUY5s0mJTDPSbqQMa9g/SV5VGY6LLTnyFRCjdiwreAWnG+DP/kuk30H+JO0MJODHgJVWkpQ0iR3AoK9sRyG16OooOLsGxUkL9CH8TpWoh4rsedsYH+HTGg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=temperror (sender ip
is 140.32.59.234) smtp.rcpttodomain=mit.edu
smtp.mailfrom=cmf.nrl.navy.mil;
dmarc=pass (p=reject sp=reject pct=100) action=none
header.from=cmf.nrl.navy.mil; dkim=pass (signature was verified)
header.d=nrl.navy.mil; arc=none (0)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=NcwtvS/iR9DBYmq0BaLGXdIa6nfeX+us4JKX1sw7hw4=;
b=pE7jqQlx3T9qEGzCR4Txu7AiRCK/XkM0+tYYxnSbgwsvE1jBSXx6ABTiuxsiTms+0I7HJ1SJTxLnpmmCawh4XJIZin3tePgfQ2BiZigdOYg0delqbwkMKSVk6tYTQbCxhVbJspwnDOaBRLkz8bn241/aLtZARkMLS5xBNKmzQu4=
Authentication-Results: spf=temperror (sender IP is 140.32.59.234)
smtp.mailfrom=cmf.nrl.navy.mil; dkim=pass (signature was verified)
header.d=nrl.navy.mil;dmarc=pass action=none header.from=cmf.nrl.navy.mil;
Received-SPF: TempError (protection.outlook.com: error in processing during
lookup of cmf.nrl.navy.mil: DNS Timeout)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nrl.navy.mil;
h=message-id : from :
to : subject : in-reply-to : references : mime-version : content-type :
date; s=s2.dkim; bh=NcwtvS/iR9DBYmq0BaLGXdIa6nfeX+us4JKX1sw7hw4=;
b=C4xl270sSujBELw4PfQmRP6RS/LaamXkVxhKDu49uZYqwNk5tw6vA45P+zfe8mlwvkAU
Xoh7fgmNTMwXFsPUFw7aJRkXE/23BXzBO40iG9dqUtzWuRcL0KyAUOBmwki/kq5mnWf6
OtI9BmKIz87WJZMci9Om3rSNAN6xU2ey8JHS89UL4w9xtu/0ob/vZXZY9YX7FaszXZHQ
iJdcPUAEaVuxkobFaEgmPihGwlJ2R1tDQBUjbP7VnfwUO78uC1AjjgL6m9M7uFJxPWB7
oL2lIkbxGoIYvodUdhQfOaX9gf5NwhxC4cxlXYt7NZ94wT+Ue8BzMULcEb8XEJj6n7vS eQ==
In-Reply-To: <992e2dea-dbd3-4f43-8b2a-7f4c8a6004c8@mit.edu>
X-Face: "Evs"_GpJ]],xS)b$T2#V&{KfP_i2`TlPrY$Iv9+TQ!6+`~+l)#7I)0xr1>4hfd{#0B4
WIn3jU;bql;{2Uq%zw5bF4?%F&&j8@KaT?#vBGk}u07<+6/`.F-3_GA@6Bq5gN9\+s;_d
gD\SW #]iN_U0 KUmOR.P<|um5yP<ea#^"SJK;C*}fMI;Mv(aiO2z~9n.w?@\>kEpSD@*e`
X-NRLCMF-Spam-Score: () hits=0 User Authenticated
X-NRLCMF-Virus-Scanned:
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: DS3PEPF0000C380:EE_|PH0PR01MB6422:EE_
X-MS-Office365-Filtering-Correlation-Id: c098f990-ab69-4429-2ccf-08dc697642f7
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;ARA:13230031|376005|61400799018|48200799009;
X-Microsoft-Antispam-Message-Info: mrrcTUAuxqgtUA+NMZj5Y+ba8thITtFU7bALiRHBd3aqrki2Nd60r3E2jhVz
cZcXdKq616OIsIizgX+C6cW1tXWzEKYshiSUKOURySqVXLFYQGVlotc705PM
fiFoSRuz8+6DXJrIA3ld6gDQWuto+vpPpxAhunxTt+0BA/vu+ECqfhUpWfr/
DJLHtzDQcv7KwAvAJmnsT/H9TQupyY2xbDl6AvmRymzXyIrFZ+pF4i/1UiFw
mXe/xxtk81RUi3+KvOiboWYmGsZC725hPkgMriDmw1QupLENDj+b3aELeM8b
nSYWxgs/I7x8R+4HUBA5N1zuovquISuvnbsjwwUD1Pm5VM+xXfRVANTJx1Qj
4yxw5F2DW6hppsmPYBmKX8ctMGcqvJrjrjTPszD4G3CSURv5LG4YaGRV1fy8
iry7m3hBr6mozrjkI7JLSFbo5rbmAF9FaVP19AjeP4kMy7McJ6EWhbt/tykQ
HsbRWm6rGg05VWIJqP9Aq02CLF7scQQzdkuOYj8TEW5f6kwJyU79QclVxbFz
hIdIoXCDdYKXBXojOe3L50HNTMcdafDhey0RHeUBIvuL9g/Ohmsov3Y80deS
krcRFnQG9BEB+CxKxoi+BAWwCe68tRA48adyUi8MUPBUUN3bFXjflx4QQXZx
3ZvOxNYfkCUtpq7RkxZlWM0hbN5Q8N5Ony3F8wSOIrkJYlJNztatfUdfZhv0
+opXvCf7FkDaZZt7FIcAMlwMtNIYTXgik8jwhD0tLn0QSnAcTnKuPW5X9e9V
NZau6ciYpNye6krv6rLADcBk5oK+sSD/lnHPQ3By/M9JPfgDAWH77v3ku6QY
XjIjpbSFqdKCvM9P+yspBMKEVqE+ri/8d4c+V0mfoC4y8JdF9XYO1N75QpyH
c5p+vVlyE2Fm2fUOrsvoYsJ9pYY2gfNxEjapmV1EFcvwHdH9BwzgHnkdi1ns
eDahljOJEfRctHr0TqzsveB6/wrF41Q0drPBeA5oxK6QbYItrWSFJDqyAgL2
kYJPYcSr/9d8xObsa8Xm73PL8or8R1P3X7YXuqkXCXSfbT2EcqNEuZQnTkjA
szcI2vSZQYsh60eh4wKPyWjPTzSJXaTckldO0alb+mLDk56KmEfgludOllSM
5DJZjGJUqET5lDN0f4ZTjVKabF7SIHA/muUlIycz1Ly6XbaSNasfRSWPTUEV
yluhB3HsoYR2xiVHcY/CXINAKqfA7KdjE9Xxrv1IUalL/D30TQk+XoI1JQm/
tBU2YDfk4wBE9e2+f5mU9pmGgpjdBtQ1zW5e5RH/YR/1zWW8PgB3SrkjZLll
UVZ1EivH9ux7zSl9ZSGYHdstYRkbmEDi9ogYXV/+S//Ac4VALGUFPFnOXxm5
hyy6+Xc=
X-Forefront-Antispam-Report: CIP:140.32.59.234; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:mf.dren.mil; PTR:mfe.dren.mil; CAT:NONE;
SFS:(13230031)(376005)(61400799018)(48200799009); DIR:OUT; SFP:1102;
X-ExternalRecipientOutboundConnectors: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-OriginatorOrg: mitprod.onmicrosoft.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 May 2024 00:33:02.9382 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: c098f990-ab69-4429-2ccf-08dc697642f7
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: DS3PEPF0000C380.namprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR01MB6422
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/options/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos/>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
X-Mailman-Original-Message-ID: <202405010033.4410X0uE000445@hedwig.cmf.nrl.navy.mil>
X-Mailman-Original-References: <CAEkxbZuz1h7Ef4N5nz3teb8vcTxTE6iBUZC+TYssUcayKHhXQQ@mail.gmail.com>
<202404152356.43FNu4Wj009470@hedwig.cmf.nrl.navy.mil>
<Zh3JEbB0IfDztgSQ@tamriel.snowman.net>
<CAEkxbZvn=3G3MVossM0aRC3pFd+JCX13ugUo6BwyKqaKtv--xg@mail.gmail.com>
<202404170130.43H1UpOg023445@hedwig.cmf.nrl.navy.mil>
<CAEkxbZupQObPrSC7PLvVV9+de8Pjj=d=dYRZWFvY3wMyUQPxMA@mail.gmail.com>
<202404301649.43UGnfNE028201@hedwig.cmf.nrl.navy.mil>
<992e2dea-dbd3-4f43-8b2a-7f4c8a6004c8@mit.edu>
 by: Ken Hornstein - Wed, 1 May 2024 00:32 UTC

>I looked at the Apple fork of Heimdal and didn't find any obvious code
>change to honor ok-as-delegate by default. In fact, it doesn't even
>implement enforce_ok_as_delegate. But both versions do implement a
>ccache config setting called "realm-config" and enforce ok-as-delegate
>if the 1 bit is set in the first byte of the value. Nothing in Heimdal
>or Apple's fork of it sets realm-config, but the macOS native ccache
>implementation or login system might do so.

You missed this code in kuser/kinit.c:

if (ok_as_delegate_flag || windows_flag || use_referrals_flag) {
unsigned char d = 0;
krb5_data data;

if (ok_as_delegate_flag || windows_flag)
d |= 1;
if (use_referrals_flag || windows_flag)
d |= 2;

data.length = 1;
data.data = &d;

krb5_cc_set_config(context, ccache, NULL, "realm-config", &data);
}

However, if I run "kinit --ok-as-delegate" in my MIT-based realm, using
the MacOS X ssh client, "ssh -K foo'" still delegates a credential fine,
so something else is clearly going on.

--Ken


devel / comp.protocols.kerberos / Re: honoring the TRUSTED_FOR_DELEGATION KDC MS-SFU Kerberos Protocol Extensions flag?

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor