MS-SFU errata changed KDC order of precedence of constrained-delegation

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

MS-SFU errata changed KDC order of precedence of constrained-delegation

Isaac Boukris
Hi Greg,

I noticed an update changing the order to prefer
ServicesAllowedToSendForwardedTicketsTo over
ServicesAllowedToReceiveForwardedTicketsFrom, which means the KDC
prefers legacy-cd over RBCD.

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-winerrata/68c4fd08-207c-4353-b59d-4d281edfb6bf

I'm not clear what the impact is, maybe the returned error in some
cases, but I think we should probably change accordingly.

Isaac
_______________________________________________
krbdev mailing list             [hidden email]
https://mailman.mit.edu/mailman/listinfo/krbdev