search for: krb5kdc_err_etype_nosupp

Hi, I set up samba on ubuntu 18.04 and join the windows AD (windows server 2016), it works fine. But when a windows client (windows server 2012R2) which only allows kerberos enctypt AES tries the access the samba server, windows AD report a kerberos error KRB5KDC_ERR_ETYPE_NOSUPP. The 'net ads enctypes list' command report the samba server support all the enctypes. 'dks4$' uses "msDS-SupportedEncryptionTypes": 31 (0x0000001f) [X] 0x00000001 DES-CBC-CRC [X] 0x00000002 DES-CBC-MD5 [X] 0x00000004 RC4-HMAC [X] 0x00000008 AES128-CTS-HMAC-SHA1-96 [X] 0x0...

Hi, I am testing Google's recent ability to integrate Chromebooks into AD and it's failing when I try to join the device to the domain. When I run wireshark during the test I notice 2 TGS-REQs from the device that are answered with KRB5KDC_ERR_ETYPE_NOSUPP. The Chromebook is only passing AES256-cts-hmac-sha1-96 and AES128-cts-hmac-sha1-96 as enc types. I was getting the same result from the device's AS-REQ, but got that to pass by raising the domain level to 2008R2 and enabling AES in the user account that I'm using to join the device to the...

...> >> Hi, >> >> I am testing Google's recent ability to integrate Chromebooks into AD and >> it's failing when I try to join the device to the domain. When I run >> wireshark during the test I notice 2 TGS-REQs from the device that are >> answered with KRB5KDC_ERR_ETYPE_NOSUPP. The Chromebook is only passing >> AES256-cts-hmac-sha1-96 and AES128-cts-hmac-sha1-96 as enc types. I was >> getting the same result from the device's AS-REQ, but got that to pass by >> raising the domain level to 2008R2 and enabling AES in the user account >> that I...

...hrieb Mike Forsman via samba: > Hi, > > I am testing Google's recent ability to integrate Chromebooks into AD and > it's failing when I try to join the device to the domain. When I run > wireshark during the test I notice 2 TGS-REQs from the device that are > answered with KRB5KDC_ERR_ETYPE_NOSUPP. The Chromebook is only passing > AES256-cts-hmac-sha1-96 and AES128-cts-hmac-sha1-96 as enc types. I was > getting the same result from the device's AS-REQ, but got that to pass by > raising the domain level to 2008R2 and enabling AES in the user account > that I'm using to joi...