Subject: Microsoft Kerberos account name case sensitivity issue ?

From: Tim Alsop <[email-masked]>
Date: Tue, 17 Feb 2004 20:06:05 -0000

Hi,
 
Has anybody else noticed a strange 'case sensitivity' issue with MS Kerberos on Win2k workstations ?
 
Lets assume that you have an account defined in AD called 'UserName'. If you then log onto a Win2k workstation using this account name and the appropriate password, when running kerbtray.exe you can see the principal name in the cache as UserName@DOMAINNAME <mailto:UserName@DOMAINNAME> , but only if you enter 'UserName' at the Windows logon screen (the GINA). If you enter 'username', 'Username' or any other mixed case varient of the actual account name on the logon screen the principal name shown in the cred cache is based on the name entered.
 
So, the issue is that principal names are supposed to be unique and Kerberos names are case sensitive, so User@DOMAIN <mailto:User@DOMAIN>  should (theoretically) be a different principal to user@DOMAIN <mailto:user@DOMAIN>  ???
 
Now, it gets very intersting because if I use Windows XP and do the same tests described above I find that the principal name case is based on the entry in AD, and not in any way related to the case of the account name entered at the windows logon. This is clearly the correct solution so Microsoft obviously fixed something in XP and it is still broken in Win2k.
 
The reason why I copied this to the group is to find out if anybody else has noticed this situation and perhaps has a solution for consistent Win2k workstation logon to AD ?

Regards, Tim.

---

From: Sam Hartman <[email-masked]>
Date: Tue, 17 Feb 2004 17:01:25 -0500

Kerberos principal names are case sensitive.  There are certain games
a KDC can play with this.  I believe Microsoft violates the spec in
their handling of this issue, but I'll agree it does end up being more
usable.

---

From: Martin Rex <[email-masked]>
Date: Wed, 18 Feb 2004 18:33:51 +0100 (MET)

> MS Kerberos on Win2k workstations ?

I had observed this annoying behaviour with NTLM 6 years ago.
(authentication at the GSS-API is strictly name-based, so this is
 a problem for portable gss-api based applications).

The issue with W2K is not only weird, it's actually quite broken,
and little if any got fixed for XP/2003.

GetUserNameEx(NameUserPrincipal) returns your Kerberos principal
                                 name, only that the realm shows up with
                                 lowercase instead of the correct uppercase

GetUserNameEx(NameSamCompatible) returns your NT4-account name as it
                                 is visualized in ACLs

TranslateName(GetUserNameEx(NameUserPrincipal),
              NameUserPrincipal,NameSamCompatible)
			         will also return the NT4-account name

TranslateName(GetUserNameEx(NameSamCompatible),
              NameSamCompatible,NameUserPrincipal)
                                 returns an error "None Mapped"

and finally:

QueryCredentialsHandle(NAMES) returns your Kerberos principal name with
                              the realm correctly in uppercase
                              EXCEPT when the credential was created with
                              an explicitly supplied user/realm pair,
                              in which case you get whatever you supplied
                              and not what is in the TGT from the KDC.

This situation is pretty annoying for a Kerberos environment,
but it is a real shame for something that calls itself "Directory"...

-Martin