O que são “Opções de ticket” Referindo-se aos logs de eventos do controlador de domínio?

Question

Estou tentando descobrir quais opções de ticket estão se referindo também neste evento de log do meu controlador de domínio. É em resposta a um pedido de autenticação do kerberos.

AgentDevice=WindowsLog
AgentLogFile=Security
PluginVersion=7.1.3.613248
Source=Security
Computer=DOMAINCONTROLLERHOSTNAME
User=SYSTEM
Domain=NT AUTHORITY
EventID=672
EventIDCode=672
EventType=8
EventCategory=9
RecordNumber=95767528
TimeGenerated=1418246782
TimeWritten=1418246782
Level=0
Keywords=0
Task=0
Opcode=0
Message=Authentication Ticket 
Request:
   User Name:  1234567
   Supplied Realm Name: MYREALM.COM
   User ID:   DOMAIN34567
   Service Name:  krbtgt
   Service ID:  MAPLE\krbtgt
   Ticket Options:  0x50800000   <-------------
   Result Code:  -
   Ticket Encryption Type: 0x17
   Pre-Authentication Type: 2
   Client Address:  10.12.32.12
   Certificate Issuer Name:
   Certificate Serial Number: 
   Certificate Thumbprint:

Não consigo encontrar nenhuma documentação sobre isso. Alguma idéia?

    

Answer 1

RFC 4120 tem sua resposta nas páginas 74 e 75. Ele diz:

kdc-options This field appears in the KRB_AS_REQ and KRB_TGS_REQ requests to the KDC and indicates the flags that the client wants set on the tickets as well as other information that is to modify the behavior of the KDC. Where appropriate, the name of an option may be the same as the flag that is set by that option. Although in most cases, the bit in the options field will be the same as that in the flags field, this is not guaranteed, so it is not acceptable simply to copy the options field to the flags field. There are various checks that must be made before an option is honored anyway.

The kdc_options field is a bit-field, where the selected options are indicated by the bit being set (1), and the unselected options and reserved fields being reset (0).

A seguir, uma lista das opções disponíveis. Há outras informações no RFC informando que algumas opções não são suportadas por padrões mais antigos, etc.