Windows 2000 compatability
**************************

Windows 2000 (formerly known as Windows NT 5) from Microsoft implements Kerberos 5.  Their implementation, however, has some quirks, peculiarities, and bugs.  This chapter is a short summary of the things that we have found out while trying to test Heimdal against Windows 2000.  Another big problem with the Kerberos implementation in Windows 2000 is the almost complete lack of documentation.

This information should apply to Heimdal VERSION and Windows 2000 RC1.  It's of course subject all the time and mostly consists of our not so inspired guesses.  Hopefully it's still somewhat useful.

Encryption types
================

Windows 2000 supports both the standard DES encryptions (des-cbc-crc and des-cbc-md5) and its own proprietary encryption that is based on md4 and rc4 and which is supposed to be described in draft-brezak-win2k-krb-rc4-hmac-01.txt.  To enable a given principal to use DES, it needs to have DES keys in the database.  To do this, you need to enable DES keys for the particular principal with the user administration tool and then change the password.

Authorization data
==================

The Windows 2000 KDC also adds extra authorization data in tickets. It is at this point unclear what triggers it to do this.  The format of this data is unknown and according to Microsoft, subject to change.  A simple way of getting hold of the data to be able to understand it better is described here.

 1. Find the client example on using the SSPI in the SDK documentation.

 2. Change ``AuthSamp'' in the source code to lowercase.

 3. Build the program.

 4. Add the ``authsamp'' principal with a known password to the database.  Make sure it has a DES key.

 5. Run ktutil add to add the key for that principal to a keytab.

 6. Run appl/test/nt_gss_server -p 2000 -s authsamp --dump-auth=file where file is an appropriate file.

 7. It should authenticate and dump for you the authorization data in the file.

 8. The tool lib/asn1/asn1_print is somewhat useful for analyzing the data.