Subject: netatalk with AuthMan UAM

From: [email-masked]
Date: Mon, 19 Mar 2001 14:44:23 -0800

Okay, this is a little more complicated than I'd really like -- HOWEVER...

I'm trying to resurrect the krb4 code in the sourceforge netatalk...
I can now successfully load Kerberos IV as a uam but things don't just
magically work and I'm hoping somebody here might be able to suggest
places for me to tinker...

First I tried using MIT's Kerberos4/5 client (and I'd like to eventually
use this anyway, but for now that can wait) unsuccessfully.  Now I'm
using the MacKerberos non-UM 2.0.4 as distributed via
www.umich.edu/~rsug...  Using the AuthMan in 2.0.4 I can successfully
acquire a kerberos 4 ticket but when I try to mount a netatalk volume
via the chooser, I get an error to the effect of "Sorry, the UAM on the
server is too old an AuthMan version".  Has anybody done any work to
netatalk to rectify this?

Alternatively, I've tried using the AuthMan UAM 1.1 (also from the same
place at umich, distributed as AuthManUAMSrc.sea) and I seem to get a
little bit further.  The appleshare client brings up a "Select Logon Method"
dialog but the listbox that ought to contain logon methods is empty.

Does this indicate that I've made a mistake building the krb4 uam?
Suggestions?

/* Sam */

---

From: [email-masked]
Date: Tue, 20 Mar 2001 09:05:47 -0500

> From:    [email-masked]
> To:      [email-masked]

> netatalk to rectify this?

Looks like you've made good progress!

The Kerberos IV server UAM that you found at sourceforge probably
doesn't match the protocol used in the most recent client UAM code.  We
made changes to both to support AFP over TCP -- Apple changed the API
to support DSI.  You can find server code that matches the most recent
client code at

    ftp://rsug.itd.umich.edu/pub/users/wes/netatalk-1.4b2+asun2.1.3um0.tar.gz

If you're interested making the most current UAM work with both AuthMan
and MIT's "Kerberos for Macintosh", we can provide you with the source
code.

Are you planning to add K5 support to the UAM and afpd?

:wes

---

From: Sam Noble <[email-masked]>
Date: Wed, 21 Mar 2001 02:51:32 -0800

I've spent the last few hours integrating the kerberos code from
um0 into the sourceforge-distributed stuff.  I've managed to get a litle
bit further with the AuthMan UAM but now I'm having more general Kerberos
problems.  We're running a recent Kerberos 5 release from MIT.  Hopefully
there's somebody here who can say "oh, you're stupid, you need to do X" or
at least a "you might want to look at Y to track down the problem".

	I realize that there might be a better forum for this problem, but
since I've not *ruled out* netatalk as the troublemaker, I'm going to hope
that there are some kerberos savy people reading this message.

	The most obvious cause of the problem is that the right stuff
isn't in /etc/srvtab (with the krb4 libraries included in the krb5
distribution, can krb4 applications read from krb5 keytab files?) but when
I use ktutil to create a srvtab file from the keytab file on the machine,
I get the following error:

ktutil:  wst /etc/srvtab
wst: Improper format of translation database entry while writing srvtab 
"/etc/srvtab"

	I'm satisfied that this might be the cause of all my troubles --
but at this point I have no idea how to deal with it.  By the way the name
of the afp server is "phebe"

from syslog:

Mar 21 02:09:12 phebe afpd[24445]: krb4_login: KRB4CMD_SESS
Mar 21 02:09:12 phebe afpd[24445]: krb4_login: krb_rd_req( &tkt, rcmd, *,
... ): Can't decode authenticator (krb_rd_req)

(I added &tkt, princ[], inst[], ... to hopefully provide a little more
insight -- it didn't really help)

relavant principles from the KDC:

afpserver/phebe@OURREALM
afpserver@OURREALM (just in case)
rcmd/phebe@OURREALM
rcmd@OURREALM (also just in case)