Restrict the enctypes in the generated krb5.conf files to Win2003 types.
authorGerald W. Carter <jerry@samba.org>
Mon, 28 Jan 2008 17:32:09 +0000 (11:32 -0600)
committerGerald W. Carter <jerry@samba.org>
Mon, 28 Jan 2008 17:32:09 +0000 (11:32 -0600)
This fixes the failure observed on FC8 when joining a Windows 2008 RC1
domain.  We currently do not handle user session keys correctly
when the KDC uses AES in the ticket replies.

source/libads/kerberos.c

index b99525047fa8c80e164f9589cbddb58498e4a9cf..d47e8a3ff1ce577764beca5404e61dfa1f69d36b 100644 (file)
@@ -865,10 +865,14 @@ bool create_local_private_krb5_conf_for_domain(const char *realm,
                return False;
        }
 
-       file_contents = talloc_asprintf(fname, "[libdefaults]\n\tdefault_realm = %s\n\n"
-                               "[realms]\n\t%s = {\n"
-                               "\t%s\t}\n",
-                               realm_upper, realm_upper, kdc_ip_string);
+       file_contents = talloc_asprintf(fname,
+                                       "[libdefaults]\n\tdefault_realm = %s\n"
+                                       "default_tgs_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n"
+                                       "default_tkt_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n"
+                                       "preferred_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n\n"
+                                       "[realms]\n\t%s = {\n"
+                                       "\t%s\t}\n",
+                                       realm_upper, realm_upper, kdc_ip_string);
 
        if (!file_contents) {
                TALLOC_FREE(dname);