From: Gerald W. Carter <jerry@samba.org>
Date: Mon, 28 Jan 2008 17:32:09 +0000 (-0600)
Subject: Restrict the enctypes in the generated krb5.conf files to Win2003 types.
X-Git-Tag: samba-3.2.0pre2~37^2~443
X-Git-Url: http://git.samba.org/?p=samba.git;a=commitdiff_plain;h=8039a2518caae54bc876368c73ec493f3cd4eb73

Restrict the enctypes in the generated krb5.conf files to Win2003 types.

This fixes the failure observed on FC8 when joining a Windows 2008 RC1
domain.  We currently do not handle user session keys correctly
when the KDC uses AES in the ticket replies.
---

diff --git a/source/libads/kerberos.c b/source/libads/kerberos.c
index b99525047fa..d47e8a3ff1c 100644
--- a/source/libads/kerberos.c
+++ b/source/libads/kerberos.c
@@ -865,10 +865,14 @@ bool create_local_private_krb5_conf_for_domain(const char *realm,
 		return False;
 	}
 
-	file_contents = talloc_asprintf(fname, "[libdefaults]\n\tdefault_realm = %s\n\n"
-				"[realms]\n\t%s = {\n"
-				"\t%s\t}\n",
-				realm_upper, realm_upper, kdc_ip_string);
+	file_contents = talloc_asprintf(fname,
+					"[libdefaults]\n\tdefault_realm = %s\n"
+					"default_tgs_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n"
+					"default_tkt_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n"
+					"preferred_enctypes = RC4-HMAC DES-CBC-CRC DES-CBC-MD5\n\n"
+					"[realms]\n\t%s = {\n"
+					"\t%s\t}\n",
+					realm_upper, realm_upper, kdc_ip_string);
 
 	if (!file_contents) {
 		TALLOC_FREE(dname);