Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

No directory.

devel / comp.protocols.kerberos / Re: Query regarding S4U2Self protocol extension

SubjectAuthor
o Re: Query regarding S4U2Self protocol extensionIsaac Boukris

1
Re: Query regarding S4U2Self protocol extension

<mailman.1.1627388857.4484.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=112&group=comp.protocols.kerberos#112

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.pch.mit.edu!not-for-mail
From: ibouk...@gmail.com (Isaac Boukris)
Newsgroups: comp.protocols.kerberos
Subject: Re: Query regarding S4U2Self protocol extension
Date: Tue, 27 Jul 2021 15:27:17 +0300
Organization: TNet Consulting
Lines: 42
Message-ID: <mailman.1.1627388857.4484.kerberos@mit.edu>
References: <CAMeQEL8+JGoqgh-j62duJBMLLoOKVPEZRWbC4mxLtdB-3ggwtw@mail.gmail.com>
<42a3d4b0-3461-5342-bf83-83475f3a0473@mit.edu>
<CAC-fF8TZcp+1YG1-7uSRfqCQ+MvTPN59tG6rxBF+0C-ReEJKiQ@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="pch.mit.edu:18.7.21.50";
logging-data="20190"; mail-complaints-to="newsmaster@tnetconsulting.net"
Cc: Vipul Mehta <vipulmehta.1989@gmail.com>, kerberos <kerberos@mit.edu>
To: Greg Hudson <ghudson@mit.edu>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=EJ0eKDkg1hVVtL8IPE3ZtkRTR5xPx8JHaae0mUn7u256COQJRc1/0aOdr8EuQE01u/InLC2h23J/NkGX1ub/LFH2sGoYEX9BVztRJUR49RUd69L+nWKSoSdu5Y8sj4Z7Mi9lcMRGWxlVlyTLip89XW6GZTBbhtkfwCawwXsL2fZvTKnyhcriXXPGQ1I0q3GW0qiNMe6U3KHPXOD9trFu3YhpAB76OjNPyMG0UXTjk7xBCLiok4pV0tTNszDCXmx+1I7QrwgYLJfGXHj3FPgAHmQMuM5BcFW5QnSQi8p/gZXSpgRGHoYBvSfiZ+x7+hrXwa/ZVMqGPLdksWQ4WCEjYQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=IMCQtjgFNoJ/fTcqj1PweDDn2Tl2kfEQN3rDinVF5S8=;
b=ewo8U6yPpfsormoWdWbd7//XVdKHPhzpjhZBZkVmfDlvRlOGV49DuImc+GOgK2tp1PBcePbRArIQxwSLBNxXmbR+26vn4zZjGhXXxGzMJeRneQKgJoCOdLXHVj0LyCfDmFXQiGx3Vl0y0X6F8H+sG6jIdg8FJ5o6OxHKwrOCnbcX1y6uSd3MNmWGLU0A9q1ZdV16iJWk1Srq2WNXognBTVzE/JGgO0+Ak3Z19FqtCu87IQAfAL7hFdAPxJj58nkheqZaD8ILBqHjfasZSU+tsBh/colClHlwDBOXI2qx9sdfVVcqZa6b7Gx/RilrjJ+Ws20vpKatMKDqT7oI1rxYag==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=IMCQtjgFNoJ/fTcqj1PweDDn2Tl2kfEQN3rDinVF5S8=;
b=KyeBz8iqUwmcEKRaoTONReon6mXwRZhI4MRdMY65uOtrziZU+dpdvj7l3mkfJO/2gi39kRPYHcmjzgwdQXt4cVZYoEKpXj6RetF9slH4CjNlAM0POjX8iLwr2XFNVjDiWvhEcN7ewubukOWwUIGXcqsJ/r/hZexnZZCSuxb78ZM=
Authentication-Results: spf=pass (sender IP is 209.85.160.176)
smtp.mailfrom=gmail.com; mit.edu; dkim=pass (signature was verified)
header.d=gmail.com; mit.edu;
dmarc=pass action=none header.from=gmail.com;
Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates
209.85.160.176 as permitted sender) receiver=protection.outlook.com;
client-ip=209.85.160.176; helo=mail-qt1-f176.google.com;
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
h=mime-version:references:in-reply-to:from:date:message-id:subject:to
:cc; bh=IMCQtjgFNoJ/fTcqj1PweDDn2Tl2kfEQN3rDinVF5S8=;
b=WdmnNsZboftWrAlWDWKXZe3MJOYXJ1itoAcM98R3srQfUNpavLPQGYcXMpz9xv00Tp
O1b/CL5lS0DgA1hfUtuLNNutzrlruAs09mNKFBB+0jTQcvlbU/tYS60Y5IjYu0QQldpm
F8FxXEadN1Vn1xMtj+L/Kk/7JJmME9wWvidS7+qHxtNrAtsvBhE+AeOaWmdmFOo8FpA7
pLvKP6fmB4dBqwzSKd1t5+qWXEOQY6TQchLBwaG5qnkTwmhAlAinfGaGBi8Zu3Ck8mUn
7k9djGVauHMiKPIy/vI0i3Dax153O6C1HOdHp+BW3WMvnunTENYHKgSrtDPexlaitlzm
6+/g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:references:in-reply-to:from:date
:message-id:subject:to:cc;
bh=IMCQtjgFNoJ/fTcqj1PweDDn2Tl2kfEQN3rDinVF5S8=;
b=I6aVldVL0C/1KvqJTy2UZ2JxZDUK3OVRfCM8KRqOROZalUbWJFgpzTxYFomDuS0R41
i6dr1Dr+ufg+HEAXYN+zVz20uAc2bcBDOQ7h8sSKSXOdZfTk9ZUGMvHNYGApAXxMS4zN
lm+3XdPZUsr6bkOyjwT1i7pryZAOJshWTYuubgBqsXPb7C44ccO2Fm+VK9YQNRRLA1Cf
UX/6qgmZZ39VARGmpjJeJtvvZ6tq/Jm1BZtC9NOpduJ/4n5iZIa9Mx9xwHzKOrVub2zk
0e1k9c3586eza9gqMO8rXkU2xXVPmq4LNsznbgaIfmQdxEpJP0bcHvVXL6m/bA8hBX69
FBeQ==
X-Gm-Message-State: AOAM533AYfbRuD85rtWJROsgKDh8O/zSwZqMGQ+xHlKWO2jT/Q4NEeZF
vDCnBybDZH3uugwNE+sAzW8NIgH4BUkQah26mETii8jKMOjaJpXO
X-Google-Smtp-Source: ABdhPJzpFCelzZf3dnmyq9MorSQ8VzFSiupZ4X/lD+e8uJm2VKE/r4j7cWge77p3XFbLTz4z7v6+c7GyeC0EG2+fpak=
X-Received: by 2002:ac8:5991:: with SMTP id e17mr18837649qte.265.1627388849034;
Tue, 27 Jul 2021 05:27:29 -0700 (PDT)
In-Reply-To: <CAC-fF8TZcp+1YG1-7uSRfqCQ+MvTPN59tG6rxBF+0C-ReEJKiQ@mail.gmail.com>
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 294cdacf-dd37-4721-4706-08d950f9e70e
X-MS-TrafficTypeDiagnostic: BN8PR01MB5458:
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <BN8PR01MB5458B382481A576AD1572B8CC9E99@BN8PR01MB5458.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:9508;
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: 0uKubkrbMKUhXaDcpJfKBTcNombfDRqvELn/emy1m4BBkEbu/DlzfhEqUGX4lO2Sw6mbjfjDUXaSIiFFzS1amAemSZLP4FtrmnVoJr2DDpjfxv1ZSP0bnE2TNMjyCXwDwSpl0ihW8AZgycHUj9SwAEZmxV1XtpBvDKdzHn6/wD0ZPmtEFdgNHZTasrIGUhrv7rSy9TjZbGiQX6ug9+GAkCM53NwgL+V8NbHRb+EOEVmWqvZwUv18MpAKlFCnCjYT/A6+Cb/c0I4vfsuqLPlVKihev6QSZzqS5XYkgpZzOVkSKNs7RsmT/VmLPJlq0+TEv5TdzQDGAhPaphcdFVKFihWFkZNsRvEeCW2sk1c+YYItIqYJdWEwDk8W/Kc9eDtAfydLjSjGIsqRAh/UqoQbdgcmJc/OqmWyFkXc3LEJ8TepzrcmagpK0nVDQY2vMI04IX9yNZxpCQfV7FYyYZCBkvrklq00T97CYggU9PvKCnzVU/NJRunKtU6sMGcMF6sxgjDe+OE7Xz2eQ/TYxld3W7APLPAZGP3IuXxRJZl15CnbEHUStpDnxUVo8nYyGNHYaaoGLHgLTbBnV6AGtsZLwy+sqLAJav0YPOfk5X2mfXDkLgspbmTOoajk9u7QF83pEvafj3CPwYdxBCA5AiqXZGaJsgWRRmPDOMX5l/B6eRBIQOGeKc2n95MiSn8U7QqZHFrqlAJFsvIEulxpGAY6cw==
X-Forefront-Antispam-Report: CIP:209.85.160.176; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:mail-qt1-f176.google.com;
PTR:mail-qt1-f176.google.com; CAT:NONE;
SFS:(4636009)(136003)(346002)(39860400002)(376002)(396003)(5660300002)(53546011)(786003)(316002)(2906002)(7596003)(76482006)(54906003)(82202003)(8676002)(42186006)(86362001)(83380400001)(73392003)(68406010)(966005)(6666004)(70586007)(7636003)(4326008)(498600001)(55446002)(26005)(6862004)(356005)(336012);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jul 2021 12:27:30.3157 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 294cdacf-dd37-4721-4706-08d950f9e70e
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT012.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR01MB5458
X-OriginatorOrg: mitprod.onmicrosoft.com
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
 by: Isaac Boukris - Tue, 27 Jul 2021 12:27 UTC

On Tue, Jul 27, 2021 at 1:17 PM Isaac Boukris <iboukris@gmail.com> wrote:
>
> On Mon, Jul 26, 2021 at 10:17 PM Greg Hudson <ghudson@mit.edu> wrote:
> >
> > On 7/23/21 4:38 PM, Vipul Mehta wrote:
> > > I did some testing with Windows KDC and it will set forwardable flag in
> > > S4U2Self service ticket in either of the following cases:
> > >
> > > 1) TrustedToAuthForDelegation is set to true in Service A account.
> > >
> > > 2) Service A TGT used in S4U2Self has forwardable flag set and
> > > msDS-AllowedToDelegateTo list is empty on Service A account.
> > > I am not able to understand why msDS-AllowedToDelegateTo needs to be empty
> > > in the 2nd case.
> > >
> > > Is the behavior of MIT KDC the same as Windows KDC ?
> >
> > We have an analog of the TrustedToAuthForDelegation flag, called
> > ok_to_auth_as_delegate. We don't check for an empty
> > allowed-to-delegate-to list.
> ...
> > https://support.microsoft.com/en-us/topic/managing-deployment-of-rbcd-protected-user-changes-for-cve-2020-16996-9a59a49f-20b9-a292-f205-da9da0ff24d3
>
> Now that I read this again, and read again the "Additional
> considerations" section in that link, I think what might happened with
> this change is that now RBCD requires the forwardable flag but any
> service with an empty msDS-AllowedToDelegateTo to list, as Vipul
> remarked, gets treated as TrustedToAuthForDelegation and gets the flag
> (presumably, unless the client is in the protected-users group or has
> the not-delegated flag).
>
> I'll run some tests and check it with dochelp.

Yes, now any service is treated as TrustedToAuthForDelegation unless
it has a none-empty msDS-AllowedToDelegateTo list, on the other hand
with
NonForwardableDelegation set to enabled RBCD is no longer allowed with
non-forwardable tickets (this would be the default soon, or it is
already).

I guess that cross-realm would also be required to be forwardable,
which means the other realm is trusted for that, I'll try to test it.

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor