Re: Realm in Username

"MS" == Sensei <senseiwa at Apple's mac dot com> writes:

MS> On 2007-03-20 08:34:00 +0100, "Miguel Sanders"
MS> <miguelsanders@xxxxxxxxxx> said:
>> Dear When using a Kerberized version of telnet, I can provide the
>> realm (so user@REALM) of the user when logging in. However when
>> using SSH, this doesn't seem to work. Is there any way to overcome
>> this? I am running AIX.

I already made a stab at answering this, which I didn't see you follow up
on. What version of telnet are you running? I have not seen one that
allowed you to say "telnet -l user@REALM host". I don't even know what
this would mean: telnet can only send credentials which it can obtain via
Kerberos from your ccache, hence only use the principal owning your TGT.
Besides, the -l argument is the authorization name, not the authentication
name, so in a Unix context this would look for a Unix *account* named
"user@REALM", which generally would not exist; there will be an account
named "user", which the Kerberos principal "user@REALM" is authorized to
access.

There is this option:

-k realm
If Kerberos authentication is being used, the -k option requests
that telnet obtain tickets for the remote host in realm realm
instead of the remote host's realm, as determined by
krb_realmofhost(3).

.... but this has nothing to do with the realm of the principal
authenticating, but rather as the doc says, gives an alternate realm for
the target host. I told you how to work around this in my earlier post.

--
Richard Silverman
res@xxxxxxxx

.

Relevant Pages

  • Re: Can IIS 6 authenticate to external Kerberos Realms?
    ... The external trust to the MIT Kerberos realm ... As far as I can tell, IIS uses Kerberos to communicate between the IIS ... server and the DCs when a user authenticates via basic authentication. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Can I Use basic or integrated authentication agains an external Kerberos KDC?
    ... > Can users who are authenticated by the KDC in UNIX realm access resources ... >> our forest using UPNs from an external Kerberos realm. ... >> authentication through IIS member servers? ... >> Eric Chamberlain ...
    (microsoft.public.inetserver.iis.security)
  • RHN satellite problem!
    ... I have users in more than one kerberos realm and am having trouble ... enabling PAM authentication for all of them. ... Users in the default realm can login to Satellite but others cannot. ...
    (RedHat)
  • Realm in Username
    ... When using a Kerberized version of telnet, I can provide the realm (so ... user@REALM) of the user when logging in. ... However when using SSH, this ...
    (comp.security.ssh)
  • Client not able to determine default realm - tried the obvious
    ... default_realm = JBTEST ... kdc = 192.168.168.3 ... logic trying to figure out the realm name. ... truss 'telnet -a 192.168.168.3' shows: ...
    (comp.protocols.kerberos)