[krbdev.mit.edu #9136] S4U2Proxy API error

"Rajbir Chahal via RT" <[email protected]> Thu, 22 Aug 2024 15:15:39 -0400

Newsgroups	gmane.comp.encryption.kerberos.bugs
Message-ID	<rt-4.4.3-2-13933-1724354139-1696.9136-4-0@kerborg-prod-app-1.mit.edu>

Thu Aug 22 15:15:39 2024: Request 9136 was acted upon.
 Transaction: Ticket created by [email protected]
       Queue: krb5
     Subject: S4U2Proxy API error
       Owner: Nobody
  Requestors: [email protected]
      Status: new
 Ticket <URL: http://kerborg-prod-app-1.mit.edu/rt/Ticket/Display.html?id=9136 >



Hello,

I am testing Kerberos S4U2Proxy API (krb5_get_credentials_for_proxy()).
Client is MIT Kerberos (version 5-1.21.2) test program, krb5-1.21.2/src/tests/s4u2proxy.c. Kerberos KDC is Active Directory (on Windows Server 2016).

On making this API call, the client receives error "-1765328371, KDC can't fulfill requested option".

Has this functionality been tested with Active Directory? Has it been tested with any other KDCs?

Please share guidance about resolving this issue.

I have reviewed the krb5-bugs archive and did not find a previous bug related to this issue.

thanks,
Rajbir