Kerberos for Windows

On Monday June 21, Computing Services released a new version of Kerberos for Windows (KfW) to the campus community. Unfortunately, with this release came a number of problems for domain users.

The problems stem from two different issues:

1) When logging into a non-Kerberized realm, any Kerberos application will cause the KfW software to first obtain tickets from the Microsoft cache. This causes the application to fail with an invalid ticket message.

The user can workaround this problem by obtaining tickets through the KfW software BEFORE they open any Kerberos-reliant application. A newer version of KfW is currently in beta; this version appears to correct the problem.

2) If an older CMUlogon package is installed on a machine (or actively being pushed via GPO to a machine) and a user installs the new KfW, the machine will experience problems when loading the CMUGina.dll file. This file stops the boot process and prevents anyone from logging in.

To resolve this issue, make sure that the version of CMUlogon is current (KfW2.1.2-CMU1.6.msi located at
\\dist\andrew\packages\cmulogon\Kerberos-Windows\ ). Also, remove all packages older than this from both the GPOs and from the individual machines (in cases where it doesn't uninstall automatically).

IMPORTANT NOTE REGARDING VERSION MANAGEMENT
Overall, the long term solution to problem 2 is careful version management across your individual departments. A quick examination of the Andrew domain hierarchy indicates that a number of departments are currently pushing the older, unsupported CMUlogon packages with CMUGina. Those departments are strongly encouraged to remove the old packages and upgrade to the current version of KfW.

Questions or problems should be directed to dept-admin@andrew.cmu.edu.