From fe0e1015bf758ba2a1d6af4a5e1ad8817f1fe63f Mon Sep 17 00:00:00 2001 From: Erik Geiser Date: Wed, 9 Jul 2025 10:47:50 +0200 Subject: [PATCH] Allow AES128 and RC tickets to support older domains --- credentials.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/credentials.go b/credentials.go index 60b95b0..3b0a1f1 100644 --- a/credentials.go +++ b/credentials.go @@ -191,11 +191,15 @@ func (c *Credential) KerberosConfig(ctx context.Context) (*config.Config, error) krbConf.LibDefaults.PermittedEnctypeIDs = []int32{etypeID.AES256_CTS_HMAC_SHA1_96} krbConf.LibDefaults.PreferredPreauthTypes = []int{int(etypeID.RC4_HMAC)} } else { - krbConf.LibDefaults.DefaultTGSEnctypeIDs = []int32{etypeID.AES256_CTS_HMAC_SHA1_96} + krbConf.LibDefaults.DefaultTGSEnctypeIDs = []int32{ + etypeID.AES256_CTS_HMAC_SHA1_96, etypeID.AES128_CTS_HMAC_SHA1_96, etypeID.RC4_HMAC, + } krbConf.LibDefaults.DefaultTktEnctypeIDs = []int32{ etypeID.AES256_CTS_HMAC_SHA1_96, etypeID.AES128_CTS_HMAC_SHA1_96, etypeID.RC4_HMAC, } - krbConf.LibDefaults.PermittedEnctypeIDs = []int32{etypeID.AES256_CTS_HMAC_SHA1_96} + krbConf.LibDefaults.PermittedEnctypeIDs = []int32{ + etypeID.AES256_CTS_HMAC_SHA1_96, etypeID.AES128_CTS_HMAC_SHA1_96, etypeID.RC4_HMAC, + } krbConf.LibDefaults.PreferredPreauthTypes = []int{ int(etypeID.AES256_CTS_HMAC_SHA1_96), int(etypeID.AES128_CTS_HMAC_SHA1_96), int(etypeID.RC4_HMAC), }