Re: Cannot delegate credentials to a ktpass-created account?

I just find out that the service ticket for myserv/h.l.d has no OK-AS-
DELEGATE flag on, while the one for host/h.l.d has it. In the AD
setting of the computer, I've already checked trusted for delegation.
Do I have to add the newly created SPN manually?

Goo

On Dec 8, 12:29 pm, Speedo <speedo...@xxxxxxxxx> wrote:
Hi

I'm writing a Windows client program to communicate with a GSS-API
server. The client program uses the current login user's credentials
(by calling AcquireCredentialsHandle(0,"Kerberos",OUTBOUND,
0,0,0,0...)), and tries to call InitializeSecurityContext
(...,target,ISC_REQ_DELEGATE|...,). The problem is, although I specify
ISC_REQ_DELEGATE in the request, the established security context does
not have the DELEGATE flag turned on.

I further find out that when I'm calling the ISC function upon the SPN
I created with ktpass, the token generated is 0x455 bytes long. On the
other hand, if I target an existing SPN, say host/host.local.domain,
the size of 0x937 bytes. After reading RFC 4120, I guess the client's
forwarded TGT is not sent with the token for the ktpass-generated SPN
case.

How can I fix this problem? The SPN is generated with

ktpass -print myserv/host.local.dom...@xxxxxxxxxxxx -mapuser
au...@xxxxxxxxxxxx -out myserv.ktab +rndPass

Thanks
Goo
.

Relevant Pages

  • Re: Cannot delegate credentials to a ktpass-created account?
    ... DELEGATE flag on, while the one for host/h.l.d has it. ... Do I have to add the newly created SPN manually? ... the established security context does ... you'll need to make sure that the SPN you use as the target is ...
    (microsoft.public.platformsdk.security)
  • Cannot delegate credentials to a ktpass-created account?
    ... I'm writing a Windows client program to communicate with a GSS-API ... I further find out that when I'm calling the ISC function upon the SPN ... I created with ktpass, the token generated is 0x455 bytes long. ...
    (microsoft.public.platformsdk.security)
  • Re: ktpass changed my UPN
    ... Second the domain should be all uppercase. ... Finally, I wanted to see the command because ktpass is usually used by folks to generate keytabs, I hadn't heard of someone doing other things with it; especially just using it to set an SPN. ...
    (microsoft.public.windows.server.active_directory)
  • ktpass changed my UPN
    ... after I ran ktpass to map an SPN to a service account, ... service account has been changed to the same as SPN. ... I don't understand why UPN has to be changed by running ktpass. ...
    (microsoft.public.windows.server.active_directory)