Share via

3.1.5.2 KDC

  • Article

If the KDC receives both a PA-PK-AS-REQ and PA-PK-AS-REQ_OLD, the KDC MUST return KRB_ERROR_GENERIC.

The KDC SHOULD<19> process the PA-PK-AS-REQ pre-authentication data identifier. The KDC SHOULD<20> respond with PA-PK-AS-REP.

The KDC MUST return the user's unicodePwd attribute ([MS-ADA3] section 2.332) in the NTLM_SUPPLEMENTAL_CREDENTIAL buffer ([MS-PAC] section 2.6.4).