Subject: [kitten] MIT krb5 1.15 interop with Windows 2003 R2 SP2

From: Weijun Wang <[email-masked]>
Date: Tue, 19 Sep 2017 21:23:08 +0800

Hi All

I am trying out MIT krb5 1.15 and using its kinit to login to a Windows 2003 R2 SP2 AD domain. The command fails with

  kinit: KDC has no support for encryption type while getting initial credentials

After some more experiments, it seems that whenever I put the aes256-sha2 etype before rc4-hmac in default_tkt_enctypes, the same error happens. It is interesting that aes128-sha2 has no such effect. The latest Heimdal kinit shows the same interop issue.

Precisely, the server does not complain with its 1st PREAUTH_REQUIRED response, and in my 2nd AS-REQ, if I provide a wrong password, the error is a normal PASSWORD_INCORRECT. Only if I provide the correct password it returns this error. Seems like it decides to choose etype of 20 but only realize it's not supported after some time.

Is this a known issue? I tried Windows 2008 and Windows 2000 and have not seen the same error.

Thanks
Max