Kerberos: The Definitive Guide

Adding a principal

To add a principal into a Windows domain controller, simply right click on the OU that you wish the user to be a member of (for example, Users) and choose New → User. Windows will bring up a New User wizard, shown in Figure A-3.

Figure A-3. Active Directory New User wizard

The new principal for this user is shown as the User logon name text box. The pre-Windows 2000 logon name is only used for NTLM authentication and not for Kerberos, so it can be ignored. The next page asks for a password and has a few options regarding password expiration and account expiration. The last page is simply a confirmation, and clicking Finish will commit the changes back to the Active Directory server.

There is one peculiarity to be aware of when using a Windows domain controller for Unix clients. The default encryption type for Kerberos keys stored in a Windows domain controller is RC4. Before you can use these principals from most Unix clients or application servers, you must modify the principal to use DES encryption keys. The process to do this is documented in the next section.