Open rilott opened 2 years ago
The methods worked for me as the salt for the tickets emitted by Active Directory comes with the format DOMAINsamAccountName
And gokrb5 tries to generate a salt with cname.GetSalt method, concatenating all the Names of the SPN which is wrong, ending with something like this: DOMAINHTTPservicePrincipalName.DOMAIN
With the salt like that, the decryption will fail.
Microsoft active directory uses it's own AES salt for keytab entries. This PR adds a new function
AddActiveDirectoryComputerAccountEntry
which handles this, and doesn't modify the normalAddEntry
function.I tried to add this with minimal code changes/duplication.
Partially fixes #416 (computer accounts only) All tests pass
Thanks! Ross