Subject: RE: Incompatibilities between Microsoft W2K3 and Kerberos 5

From: "Paul Leach" <[email-masked]>
Date: Fri, 12 Mar 2004 10:58:38 -0800

Let me toss in an observation which I vaguely recall had something to do
with how the present situation arose, but can't remember the details:

Imagine you have two systems, one of which is case-insensitive, and the
other is case-sensitive. How can you get names entered on the former to be
usable by the latter? By being case-preserving.

---

From: Martin Rex <[email-masked]>
Date: Fri, 12 Mar 2004 20:12:26 +0100 (MET)

> usable by the latter? By being case-preserving.

We have a different situation with Kerberos.
Currently W2K3 AD breaks Single Sign-On with kerberized or gssapi based
applications (which can only key on kerberos principal names) because of an
inappropriate translation of Windows NT account names into Kerberos
principal names.

- The underlying Kerberos protocol is and has always been case-sensitive.
- Microsoft Windows account naming has always been case-insensitive.

How could one offer the usability feature case-insensivity when using
Kerberos on a Microsoft platform for logon and Single Sign-On?

By realizing that it is a usability issue and that the usability
feature needs to be implemented exactly there where a user-supplied
NT account name is transformed into a Kerberos principal name,
e.g. Winlogon/Gina and the LogonUser-API.

Of course this means that when using a Unix Kerberos software
to request tickets from a Microsoft Active Directory/KDC, then
the name that a user passes to "kinit" is probably case sensitive,
because it will be a Kerberos principal name and *NOT* the
name of an NT account.  Adding a similar usability enhancement
to unix-based kerberos clients is possible, of course.

-Martin