3.4.5 Message Processing Events and Sequencing Rules

  • Article

Kerberos V5 specifies several additional messages ([RFC4120] sections 3.4 through 3.6) that are associated with the session after the AP exchange has completed.

KILE does not implement KRB_SAFE messages ([RFC4120] section 3.4).

KILE does not implement KRB_PRIV messages with a time stamp ([RFC4120] section 3.5). KILE implements KRB_PRIV messages with a sequence number ([RFC4120] section 3.5).

KILE implements KRB_CRED messages ([RFC4120] section 3.6).

KILE will return a zero-length message whenever it receives a message that is either not well-formed or not supported.

If the decryption of the ticket fails and the KILE server has older versions of the server key, the server retries decrypting the ticket with the older keys.

If the decryption routines detect a modification of the ticket, the KRB_AP_ERR_MODIFIED error message is returned.

If decryption shows that the authenticator has been modified, the KRB_AP_ERR_MODIFIED error message is returned.

When clock skew errors occur during AP exchanges, the application server attempts a clock skew recovery by returning a KRB_AP_ERR_SKEW error ([RFC4120] section 3.2.3) containing a KERB-ERROR-DATA structure (section 2.2.2) in the e-data field of the KRB-ERROR message ([RFC4120] section 5.9.1).

When the checksum field is not present, the application server processes the requests as though none of the flags ([RFC4121] section 4.1.1.1) are set and does not check channel binding information ([RFC4121] section 4.1.1.2) as it is likewise not present.

When the server receives AP exchange requests for SPNs with the serviceclass string equal to "RestrictedKrbHost", it will decrypt the ticket with the computer account's key and either create or use the session key for the "RestrictedKrbHost", regardless of the account the target service is running as.<77>

If the ApplicationRequiresCBT parameter (section 3.4.1) is set to TRUE, the server, if so configured, SHOULD<78> return GSS_S_BAD_BINDINGS whenever the AP exchange request message contains an all-zero channel binding value and does not contain the AD-IF-RELEVANT element ([RFC4120] section 5.2.6.1) KERB_AP_OPTIONS_CBT.

If the service ticket received for the computer's principal is encrypted with DES, the KILE server MUST return KRB_AP_ERR_MODIFIED regardless of supporting DES.<79>