https://k5wiki.kerberos.org/wiki?action=history&feed=atom&title=Ops_feedback_notes_2014-09-02 2026-05-04T15:08:15Z Revision history for this page on the wiki MediaWiki 1.27.4 https://k5wiki.kerberos.org/wiki?title=Ops_feedback_notes_2014-09-02&diff=5396&oldid=prev 2014-09-03T21:33:30Z

<p>New page: {{opsnotes|2014}} ==Windows interop== One-way trust between Windows and MIT. Global identity in Windows. Auth to Unix. Pain point getting Windows client to know when a service is in a...</p> <p><b>New page</b></p><div>{{opsnotes|2014}}<br /> <br /> ==Windows interop==<br /> <br /> One-way trust between Windows and MIT. Global identity in Windows. Auth to Unix. Pain point getting Windows client to know when a service is in a different realm. There is no Windows equivalent to wildcarding mapping of domain names to realm names; had to enumerate subdomains.<br /> <br /> Windows native client should be able to follow realm referrals. It might not be obvious how to configure this on the DC though.<br /> <br /> ==PKINIT==<br /> <br /> Difficulties configuring MIT client to do PKINIT to a Windows KDC. Docs for MIT PKINIT client are less useful than docs for MIT PKINIT server.<br /> <br /> ==Java==<br /> <br /> Apparently there are some problems with AES256 support on Java 7, 8 on Linux, with a Windows KDC. The AS-REQ works but not the TGS-REQ. We need a few more details before we can diagnose.</div>

TomYu