Re: Oracle ODP.NET use of MIT KfW

Hi, thanks for the info Greg!

We are in the process of the retesting the Credential Guard issue, and 
will let you know shortly what we see.

Thanks, Scot

On 7/24/2020 2:46 PM, Greg Hudson wrote:
> On 7/24/20 4:41 PM, Scot McKinley wrote:
>> * The announcement pages for the KfW have quoted support for the exact
>> same Windows versions for at least 7 years, probably longer. The below
>> statement has been exactly the same for versions 4.0.1, 4.1 AND the new
>> 4.2beta1. Can we get it updated?
> I've made a note to update it.
>
>> * The Microsoft Credential Guard blocks acquisition of windows domain
>> based TGTs, thus blocking MSLSA based KfW credential acquisition. Has
>> this been addressed in 4.2beta1 or are there plans to address it (eg, by
>> switching to a SSPI based credential acquisition)?
> When using the MSLSA cache, KfW attempts to acquire credentials via the
> SSPI (LsaCallAuthenticationPackage with
> KERB_RETRIEVE_TICKET_CACHE_TICKET).  For local-realm use, it should not
> be necessary to retrieve the TGT.
>
> If Credential Guard is blocking even the obtaining of service tickets by
> applications (I'm not clear on whether this is true), then it's
> conceivable that libgssapi_krb5 could use the LSA to obtain GSS tokens,
> bypassing libkrb5 altogether.  At that point it might be simpler to use
> a GSS shim to the Microsoft krb5 implementation, which I believe already
> exists.
_______________________________________________
krbdev mailing list             [email protected]
https://mailman.mit.edu/mailman/listinfo/krbdev