Web lists-archives.com

[Samba] forest trust


after set transitive forest trust with win2008R2
problems with processing GPO
some logs in samba show problems with kerberos constrained delegation

Kerberos: TGS-REQ W7-WRK1$@SFB.TEST.SIP.OFFICE.GL from ipv4: for w7-wrk1$\@
SFB.TEST.SIP.OFFICE.GL@xxxxxxxxxxxxxxxxxxxxxx [canonicalize,
request-anonymous, renewable, forwardable]
Kerberos: Bad request for constrained delegation
Kerberos: constrained delegation from W7-WRK1$@SFB.TEST.SIP.OFFICE.GL
(w7-wrk1$\@SFB.TEST.SIP.OFFICE.GL@xxxxxxxxxxxxxxxxxxxxxx) as W7-WRK1$@
SFB.TEST.SIP.OFFICE.GL to w7-wrk1$\@
SFB.TEST.SIP.OFFICE.GL@xxxxxxxxxxxxxxxxxxxxxx not allowed
Kerberos: Failed building TGS-REP to ipv4:

problem with check constrained delegation
in /kdc/krb5tgs.c
function check_constrained_delegation

if(!krb5_realm_compare(context, client->entry.principal,
server->entry.principal)) {
kdc_log(context, config, 0,
   "Bad request for constrained delegation");
return ret;

this function just strcmp of realms char*

no idea why it failed
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba