Kerberos and MOSS case sensitive?

re: Kerberos and MOSS case sensitive?

PaulE — Tue, 16 Jun 2009 21:59:33 GMT

Wow, thanks Shane! I was going NUTS trying to figure out why I wasn't getting my Kerberos tickets for the MSSP SPNs. Turns out, my admin put in the last part of the SPN (the part that identifies the name of the SSP) in lower case and I was creating the SSP with a name in all caps. Once I recreated the SSP with a name to match the case used by our Actice Directory Admin in the SPNs, I started getting the MSSP tickets. Hooray!

SharePoint: Useability Links | Alpesh Nakars' Blogosphere

SharePoint: Useability Links | Alpesh Nakars' Blogosphere — Fri, 26 Oct 2007 04:26:56 GMT

Pingback from SharePoint: Useability Links | Alpesh Nakars' Blogosphere

re: Kerberos and MOSS case sensitive?

Brian Arkills — Tue, 09 Oct 2007 15:52:29 GMT

RFC4120 specifies the Kerberos 5 protocol.

Section 5.2.1 defines valid kerberosstring as IA5String, so there is case sensitivity in the protocol.

Section 6.1 makes it abundantly clear that realm names are case sensitive, even though the domain names underlying them are not.

Section 6.2.1 deals with the Name of Server Principals and says:

"Where the name of the host is not case sensitive (for example, with Internet domain names) the name of the host MUST be lowercase."

So the SPN *must* be lowercase, but because the protocol allows case, depending on the implementation, you can end up with situations where case matters.

re: Kerberos and MOSS case sensitive?

jacobmross — Sat, 29 Sep 2007 22:10:10 GMT

I've been battling with Kerberos and MOSS as well.

My issues were slightly different, but seeing this post at least partially confirms a suspicion I've shared for a long time as well.

I generally write code in C#, so I've gotten into the habit of trying to be case sensitive with most things even when it probably doesn't matter.

I ran into a very similar issue while battling the bigger issue - and as a precaution, went ahead and did exactly the same thing - tweaked all of my SPN's to ensure they were case-correct. Glad I'm not alone in this observation.

re: Kerberos and MOSS case sensitive?

Kanwal — Thu, 27 Sep 2007 12:51:58 GMT

I haven't had too much time to be able to devote to Halo 3. How are you liking it?

re: Kerberos and MOSS case sensitive?

Sindre Solem — Thu, 27 Sep 2007 08:16:28 GMT

SPNs should NOT be case sensitive on the Windows Platform. But it may differ with various implementations, i.e. UNIX implementations.