Re: Heimdal and Digest service

On Apr 24, 2014, at 10:37 , Yoann Gini <[email protected]> wrote:

> Hello,
> 
> I use Heimdal as my only password database and it work like a charm.
> 
> But I’ve one problem, one of my services (SIP) support only DIGEST authentication…
> 
> I’ve build my Heimdal 1.5.2 on FreeBSD 10 with the DIGEST support, but I didn’t find any documentation to use it…
> 
> What am I supposed to do to use Heimdal as a authentication backend for service who need DIGEST authentication ?

There is little written about it at random places on the Internet…

But in short, you need to add:

[kdc]
        enable-digest = true
        digests_allowed = chap-md5,ms-chap-v2
[kadmin]
        save-password = true

In your KDCs krb5.conf configuration and you need the special "digest" principal (eg. digest/YOURREALMGOESHERE@YOURREALMGOESHERE)

Lastly, you need to add the attribute "allow-digest" to the service principal(s) that should utilise digest authentication.

(See kdigest help <...> for a dense command line reference (for the client side))

HTH,
/P