Subject: [Fwd: BOUNCE [email-masked]: Non-member submission from ["Actually davidchr" <[email-masked]>]]

From: "Douglas E. Engert" <[email-masked]>
Date: Fri, 12 Mar 2004 06:21:59 -0600

approved: Secret_word
Subject: RE: Incompatibilities between Microsoft W2K3 and Kerberos 5
Date: Thu, 11 Mar 2004 16:55:16 -0800
From: "Actually davidchr" <[email-masked]>
To: <[email-masked]>, "Sam Hartman" <[email-masked]>
Cc: <[email-masked]>, <[email-masked]>

> > What would you have them do instead?
> 
> Canonicalize the NT account name which the user typed in 
> locally and use
> that to request tickets from the KDC.  That seems to work well on W2K,
> so I really don't understand why they broke it in W2K3.

How could a workstation securely and performantly canonicalize a
principalname BEFORE making an AS-REQ if that workstation does not
ALREADY have access to KDC data?  

We request name canonicalization under most circumstances WITH the
AS-REQ, which is, to my knowledge, what you're after despite it being a
violation of the spec.  If you have more questions about this, please
contact Larry or myself (davidchr-a.t-microsoft-d.o.t-com).

I'm pretty sure I discussed this with you two weeks ago, Martin.  If you
have or had issue with my solution or explanation, you know how to reach
us.  Why you're spamming the list with this today is beyond me.

Thanks!
-Dave

---
This message is provided "AS IS" with no warranties, and confers no
rights.
This message may originate from an unmonitored alias ("davespam") for
spam-reduction purposes.  Use "davidchr" for individual replies.
Any opinions or policies stated within are my own and do not necessarily
constitute those of my employer.
This message originates in the State of Washington (USA), where
unsolicited commercial email is legally actionable (see
http://www.wa-state-resident.com).
Harvesting of this address for purposes of bulk email (including "spam")
is prohibited unless by my expressed prior request.  I retaliate
viciously against spammers and spam sites.