3 KERBEROS5 DEFINITIONS ::=
6 NAME-TYPE ::= INTEGER {
7 KRB5_NT_UNKNOWN(0), -- Name type not known
8 KRB5_NT_PRINCIPAL(1), -- Just the name of the principal as in
9 KRB5_NT_SRV_INST(2), -- Service and other unique instance (krbtgt)
10 KRB5_NT_SRV_HST(3), -- Service with host name as instance
11 KRB5_NT_SRV_XHST(4), -- Service with host as remaining components
12 KRB5_NT_UID(5), -- Unique ID
13 KRB5_NT_X500_PRINCIPAL(6), -- PKINIT
14 KRB5_NT_SMTP_NAME(7), -- Name in form of SMTP email name
15 KRB5_NT_ENTERPRISE_PRINCIPAL(10), -- Windows 2000 UPN
16 KRB5_NT_ENT_PRINCIPAL_AND_ID(-130), -- Windows 2000 UPN and SID
17 KRB5_NT_MS_PRINCIPAL(-128), -- NT 4 style name
18 KRB5_NT_MS_PRINCIPAL_AND_ID(-129) -- NT style name and SID
23 MESSAGE-TYPE ::= INTEGER {
24 krb-as-req(10), -- Request for initial authentication
25 krb-as-rep(11), -- Response to KRB_AS_REQ request
26 krb-tgs-req(12), -- Request for authentication based on TGT
27 krb-tgs-rep(13), -- Response to KRB_TGS_REQ request
28 krb-ap-req(14), -- application request to server
29 krb-ap-rep(15), -- Response to KRB_AP_REQ_MUTUAL
30 krb-safe(20), -- Safe (checksummed) application message
31 krb-priv(21), -- Private (encrypted) application message
32 krb-cred(22), -- Private (encrypted) message to forward credentials
33 krb-error(30) -- Error response
39 PADATA-TYPE ::= INTEGER {
41 KRB5-PADATA-TGS-REQ(1),
42 KRB5-PADATA-AP-REQ(1),
43 KRB5-PADATA-ENC-TIMESTAMP(2),
44 KRB5-PADATA-PW-SALT(3),
45 KRB5-PADATA-ENC-UNIX-TIME(5),
46 KRB5-PADATA-SANDIA-SECUREID(6),
47 KRB5-PADATA-SESAME(7),
48 KRB5-PADATA-OSF-DCE(8),
49 KRB5-PADATA-CYBERSAFE-SECUREID(9),
50 KRB5-PADATA-AFS3-SALT(10),
51 KRB5-PADATA-ETYPE-INFO(11),
52 KRB5-PADATA-SAM-CHALLENGE(12), -- (sam/otp)
53 KRB5-PADATA-SAM-RESPONSE(13), -- (sam/otp)
54 KRB5-PADATA-PK-AS-REQ-19(14), -- (PKINIT-19)
55 KRB5-PADATA-PK-AS-REP-19(15), -- (PKINIT-19)
56 KRB5-PADATA-PK-AS-REQ-WIN(15), -- (PKINIT - old number)
57 KRB5-PADATA-PK-AS-REQ(16), -- (PKINIT-25)
58 KRB5-PADATA-PK-AS-REP(17), -- (PKINIT-25)
59 KRB5-PADATA-PA-PK-OCSP-RESPONSE(18),
60 KRB5-PADATA-ETYPE-INFO2(19),
61 KRB5-PADATA-USE-SPECIFIED-KVNO(20),
62 KRB5-PADATA-SVR-REFERRAL-INFO(20), --- old ms referral number
63 KRB5-PADATA-SAM-REDIRECT(21), -- (sam/otp)
64 KRB5-PADATA-GET-FROM-TYPED-DATA(22),
65 KRB5-PADATA-SAM-ETYPE-INFO(23),
66 KRB5-PADATA-SERVER-REFERRAL(25),
67 KRB5-PADATA-TD-KRB-PRINCIPAL(102), -- PrincipalName
68 KRB5-PADATA-PK-TD-TRUSTED-CERTIFIERS(104), -- PKINIT
69 KRB5-PADATA-PK-TD-CERTIFICATE-INDEX(105), -- PKINIT
70 KRB5-PADATA-TD-APP-DEFINED-ERROR(106), -- application specific
71 KRB5-PADATA-TD-REQ-NONCE(107), -- INTEGER
72 KRB5-PADATA-TD-REQ-SEQ(108), -- INTEGER
73 KRB5-PADATA-PA-PAC-REQUEST(128), -- jbrezak@exchange.microsoft.com
74 KRB5-PADATA-S4U2SELF(129),
75 KRB5-PADATA-EPAC(130), -- EPAK
76 KRB5-PADATA-PK-AS-09-BINDING(132), -- client send this to
77 -- tell KDC that is supports
78 -- the asCheckSum in the
80 KRB5-PADATA-CLIENT-CANONICALIZED(133) --
83 AUTHDATA-TYPE ::= INTEGER {
84 KRB5-AUTHDATA-IF-RELEVANT(1),
85 KRB5-AUTHDATA-INTENDED-FOR_SERVER(2),
86 KRB5-AUTHDATA-INTENDED-FOR-APPLICATION-CLASS(3),
87 KRB5-AUTHDATA-KDC-ISSUED(4),
88 KRB5-AUTHDATA-AND-OR(5),
89 KRB5-AUTHDATA-MANDATORY-TICKET-EXTENSIONS(6),
90 KRB5-AUTHDATA-IN-TICKET-EXTENSIONS(7),
91 KRB5-AUTHDATA-MANDATORY-FOR-KDC(8),
92 KRB5-AUTHDATA-INITIAL-VERIFIED-CAS(9),
93 KRB5-AUTHDATA-OSF-DCE(64),
94 KRB5-AUTHDATA-SESAME(65),
95 KRB5-AUTHDATA-OSF-DCE-PKI-CERTID(66),
96 KRB5-AUTHDATA-WIN2K-PAC(128),
97 KRB5-AUTHDATA-GSS-API-ETYPE-NEGOTIATION(129), -- Authenticator only
98 KRB5-AUTHDATA-SIGNTICKET-OLD(-17),
99 KRB5-AUTHDATA-SIGNTICKET(142)
104 CKSUMTYPE ::= INTEGER {
107 CKSUMTYPE_RSA_MD4(2),
108 CKSUMTYPE_RSA_MD4_DES(3),
109 CKSUMTYPE_DES_MAC(4),
110 CKSUMTYPE_DES_MAC_K(5),
111 CKSUMTYPE_RSA_MD4_DES_K(6),
112 CKSUMTYPE_RSA_MD5(7),
113 CKSUMTYPE_RSA_MD5_DES(8),
114 CKSUMTYPE_RSA_MD5_DES3(9),
115 CKSUMTYPE_SHA1_OTHER(10),
116 CKSUMTYPE_HMAC_SHA1_DES3(12),
118 CKSUMTYPE_HMAC_SHA1_96_AES_128(15),
119 CKSUMTYPE_HMAC_SHA1_96_AES_256(16),
120 CKSUMTYPE_GSSAPI(0x8003),
121 CKSUMTYPE_HMAC_MD5(-138), -- unofficial microsoft number
122 CKSUMTYPE_HMAC_MD5_ENC(-1138) -- even more unofficial
126 ENCTYPE ::= INTEGER {
128 ETYPE_DES_CBC_CRC(1),
129 ETYPE_DES_CBC_MD4(2),
130 ETYPE_DES_CBC_MD5(3),
131 ETYPE_DES3_CBC_MD5(5),
132 ETYPE_OLD_DES3_CBC_SHA1(7),
133 ETYPE_SIGN_DSA_GENERATE(8),
134 ETYPE_ENCRYPT_RSA_PRIV(9),
135 ETYPE_ENCRYPT_RSA_PUB(10),
136 ETYPE_DES3_CBC_SHA1(16), -- with key derivation
137 ETYPE_AES128_CTS_HMAC_SHA1_96(17),
138 ETYPE_AES256_CTS_HMAC_SHA1_96(18),
139 ETYPE_ARCFOUR_HMAC_MD5(23),
140 ETYPE_ARCFOUR_HMAC_MD5_56(24),
141 ETYPE_ENCTYPE_PK_CROSS(48),
142 -- some "old" windows types
143 ETYPE_ARCFOUR_MD4(-128),
144 ETYPE_ARCFOUR_HMAC_OLD(-133),
145 ETYPE_ARCFOUR_HMAC_OLD_EXP(-135),
146 -- these are for Heimdal internal use
147 ETYPE_DES_CBC_NONE(-0x1000),
148 ETYPE_DES3_CBC_NONE(-0x1001),
149 ETYPE_DES_CFB64_NONE(-0x1002),
150 ETYPE_DES_PCBC_NONE(-0x1003),
151 ETYPE_DIGEST_MD5_NONE(-0x1004), -- private use, lukeh@padl.com
152 ETYPE_CRAM_MD5_NONE(-0x1005) -- private use, lukeh@padl.com
158 -- this is sugar to make something ASN1 does not have: unsigned
160 krb5uint32 ::= INTEGER (0..4294967295)
161 krb5int32 ::= INTEGER (-2147483648..2147483647)
163 KerberosString ::= GeneralString
165 Realm ::= GeneralString
166 PrincipalName ::= SEQUENCE {
167 name-type[0] NAME-TYPE,
168 name-string[1] SEQUENCE OF GeneralString
171 -- this is not part of RFC1510
172 Principal ::= SEQUENCE {
173 name[0] PrincipalName,
177 HostAddress ::= SEQUENCE {
178 addr-type[0] krb5int32,
179 address[1] OCTET STRING
182 -- This is from RFC1510.
184 -- HostAddresses ::= SEQUENCE OF SEQUENCE {
185 -- addr-type[0] krb5int32,
186 -- address[1] OCTET STRING
189 -- This seems much better.
190 HostAddresses ::= SEQUENCE OF HostAddress
193 KerberosTime ::= GeneralizedTime -- Specifying UTC time zone (Z)
195 AuthorizationDataElement ::= SEQUENCE {
196 ad-type[0] krb5int32,
197 ad-data[1] OCTET STRING
200 AuthorizationData ::= SEQUENCE OF AuthorizationDataElement
202 APOptions ::= BIT STRING {
208 TicketFlags ::= BIT STRING {
221 transited-policy-checked(12),
226 KDCOptions ::= BIT STRING {
239 request-anonymous(14),
241 constrained-delegation(16), -- ms extension
242 disable-transited-check(26),
249 LR-TYPE ::= INTEGER {
250 LR_NONE(0), -- no information
251 LR_INITIAL_TGT(1), -- last initial TGT request
252 LR_INITIAL(2), -- last initial request
253 LR_ISSUE_USE_TGT(3), -- time of newest TGT used
254 LR_RENEWAL(4), -- time of last renewal
255 LR_REQUEST(5), -- time of last request (of any type)
256 LR_PW_EXPTIME(6), -- expiration time of password
257 LR_ACCT_EXPTIME(7) -- expiration time of account
260 LastReq ::= SEQUENCE OF SEQUENCE {
262 lr-value[1] KerberosTime
266 EncryptedData ::= SEQUENCE {
267 etype[0] ENCTYPE, -- EncryptionType
268 kvno[1] krb5int32 OPTIONAL,
269 cipher[2] OCTET STRING -- ciphertext
272 EncryptionKey ::= SEQUENCE {
273 keytype[0] krb5int32,
274 keyvalue[1] OCTET STRING
277 -- encoded Transited field
278 TransitedEncoding ::= SEQUENCE {
279 tr-type[0] krb5int32, -- must be registered
280 contents[1] OCTET STRING
283 Ticket ::= [APPLICATION 1] SEQUENCE {
284 tkt-vno[0] krb5int32,
286 sname[2] PrincipalName,
287 enc-part[3] EncryptedData
289 -- Encrypted part of ticket
290 EncTicketPart ::= [APPLICATION 3] SEQUENCE {
291 flags[0] TicketFlags,
292 key[1] EncryptionKey,
294 cname[3] PrincipalName,
295 transited[4] TransitedEncoding,
296 authtime[5] KerberosTime,
297 starttime[6] KerberosTime OPTIONAL,
298 endtime[7] KerberosTime,
299 renew-till[8] KerberosTime OPTIONAL,
300 caddr[9] HostAddresses OPTIONAL,
301 authorization-data[10] AuthorizationData OPTIONAL
304 Checksum ::= SEQUENCE {
305 cksumtype[0] CKSUMTYPE,
306 checksum[1] OCTET STRING
309 Authenticator ::= [APPLICATION 2] SEQUENCE {
310 authenticator-vno[0] krb5int32,
312 cname[2] PrincipalName,
313 cksum[3] Checksum OPTIONAL,
315 ctime[5] KerberosTime,
316 subkey[6] EncryptionKey OPTIONAL,
317 seq-number[7] krb5uint32 OPTIONAL,
318 authorization-data[8] AuthorizationData OPTIONAL
321 PA-DATA ::= SEQUENCE {
322 -- might be encoded AP-REQ
323 padata-type[1] PADATA-TYPE,
324 padata-value[2] OCTET STRING
327 ETYPE-INFO-ENTRY ::= SEQUENCE {
329 salt[1] OCTET STRING OPTIONAL,
330 salttype[2] krb5int32 OPTIONAL
333 ETYPE-INFO ::= SEQUENCE OF ETYPE-INFO-ENTRY
335 ETYPE-INFO2-ENTRY ::= SEQUENCE {
337 salt[1] KerberosString OPTIONAL,
338 s2kparams[2] OCTET STRING OPTIONAL
341 ETYPE-INFO2 ::= SEQUENCE SIZE (1..MAX) OF ETYPE-INFO2-ENTRY
343 METHOD-DATA ::= SEQUENCE OF PA-DATA
345 TypedData ::= SEQUENCE {
346 data-type[0] krb5int32,
347 data-value[1] OCTET STRING OPTIONAL
350 TYPED-DATA ::= SEQUENCE SIZE (1..MAX) OF TypedData
352 KDC-REQ-BODY ::= SEQUENCE {
353 kdc-options[0] KDCOptions,
354 cname[1] PrincipalName OPTIONAL, -- Used only in AS-REQ
355 realm[2] Realm, -- Server's realm
356 -- Also client's in AS-REQ
357 sname[3] PrincipalName OPTIONAL,
358 from[4] KerberosTime OPTIONAL,
359 till[5] KerberosTime OPTIONAL,
360 rtime[6] KerberosTime OPTIONAL,
362 etype[8] SEQUENCE OF ENCTYPE, -- EncryptionType,
363 -- in preference order
364 addresses[9] HostAddresses OPTIONAL,
365 enc-authorization-data[10] EncryptedData OPTIONAL,
366 -- Encrypted AuthorizationData encoding
367 additional-tickets[11] SEQUENCE OF Ticket OPTIONAL
370 KDC-REQ ::= SEQUENCE {
372 msg-type[2] MESSAGE-TYPE,
373 padata[3] METHOD-DATA OPTIONAL,
374 req-body[4] KDC-REQ-BODY
377 AS-REQ ::= [APPLICATION 10] KDC-REQ
378 TGS-REQ ::= [APPLICATION 12] KDC-REQ
380 -- padata-type ::= PA-ENC-TIMESTAMP
381 -- padata-value ::= EncryptedData - PA-ENC-TS-ENC
383 PA-ENC-TS-ENC ::= SEQUENCE {
384 patimestamp[0] KerberosTime, -- client's time
385 pausec[1] krb5int32 OPTIONAL
388 -- draft-brezak-win2k-krb-authz-01
389 PA-PAC-REQUEST ::= SEQUENCE {
390 include-pac[0] BOOLEAN -- Indicates whether a PAC
391 -- should be included or not
394 -- PacketCable provisioning server location, PKT-SP-SEC-I09-030728.pdf
395 PROV-SRV-LOCATION ::= GeneralString
397 KDC-REP ::= SEQUENCE {
399 msg-type[1] MESSAGE-TYPE,
400 padata[2] METHOD-DATA OPTIONAL,
402 cname[4] PrincipalName,
404 enc-part[6] EncryptedData
407 AS-REP ::= [APPLICATION 11] KDC-REP
408 TGS-REP ::= [APPLICATION 13] KDC-REP
410 EncKDCRepPart ::= SEQUENCE {
411 key[0] EncryptionKey,
414 key-expiration[3] KerberosTime OPTIONAL,
415 flags[4] TicketFlags,
416 authtime[5] KerberosTime,
417 starttime[6] KerberosTime OPTIONAL,
418 endtime[7] KerberosTime,
419 renew-till[8] KerberosTime OPTIONAL,
421 sname[10] PrincipalName,
422 caddr[11] HostAddresses OPTIONAL,
423 encrypted-pa-data[12] METHOD-DATA OPTIONAL
426 EncASRepPart ::= [APPLICATION 25] EncKDCRepPart
427 EncTGSRepPart ::= [APPLICATION 26] EncKDCRepPart
429 AP-REQ ::= [APPLICATION 14] SEQUENCE {
431 msg-type[1] MESSAGE-TYPE,
432 ap-options[2] APOptions,
434 authenticator[4] EncryptedData
437 AP-REP ::= [APPLICATION 15] SEQUENCE {
439 msg-type[1] MESSAGE-TYPE,
440 enc-part[2] EncryptedData
443 EncAPRepPart ::= [APPLICATION 27] SEQUENCE {
444 ctime[0] KerberosTime,
446 subkey[2] EncryptionKey OPTIONAL,
447 seq-number[3] krb5uint32 OPTIONAL
450 KRB-SAFE-BODY ::= SEQUENCE {
451 user-data[0] OCTET STRING,
452 timestamp[1] KerberosTime OPTIONAL,
453 usec[2] krb5int32 OPTIONAL,
454 seq-number[3] krb5uint32 OPTIONAL,
455 s-address[4] HostAddress OPTIONAL,
456 r-address[5] HostAddress OPTIONAL
459 KRB-SAFE ::= [APPLICATION 20] SEQUENCE {
461 msg-type[1] MESSAGE-TYPE,
462 safe-body[2] KRB-SAFE-BODY,
466 KRB-PRIV ::= [APPLICATION 21] SEQUENCE {
468 msg-type[1] MESSAGE-TYPE,
469 enc-part[3] EncryptedData
471 EncKrbPrivPart ::= [APPLICATION 28] SEQUENCE {
472 user-data[0] OCTET STRING,
473 timestamp[1] KerberosTime OPTIONAL,
474 usec[2] krb5int32 OPTIONAL,
475 seq-number[3] krb5uint32 OPTIONAL,
476 s-address[4] HostAddress OPTIONAL, -- sender's addr
477 r-address[5] HostAddress OPTIONAL -- recip's addr
480 KRB-CRED ::= [APPLICATION 22] SEQUENCE {
482 msg-type[1] MESSAGE-TYPE, -- KRB_CRED
483 tickets[2] SEQUENCE OF Ticket,
484 enc-part[3] EncryptedData
487 KrbCredInfo ::= SEQUENCE {
488 key[0] EncryptionKey,
489 prealm[1] Realm OPTIONAL,
490 pname[2] PrincipalName OPTIONAL,
491 flags[3] TicketFlags OPTIONAL,
492 authtime[4] KerberosTime OPTIONAL,
493 starttime[5] KerberosTime OPTIONAL,
494 endtime[6] KerberosTime OPTIONAL,
495 renew-till[7] KerberosTime OPTIONAL,
496 srealm[8] Realm OPTIONAL,
497 sname[9] PrincipalName OPTIONAL,
498 caddr[10] HostAddresses OPTIONAL
501 EncKrbCredPart ::= [APPLICATION 29] SEQUENCE {
502 ticket-info[0] SEQUENCE OF KrbCredInfo,
503 nonce[1] krb5int32 OPTIONAL,
504 timestamp[2] KerberosTime OPTIONAL,
505 usec[3] krb5int32 OPTIONAL,
506 s-address[4] HostAddress OPTIONAL,
507 r-address[5] HostAddress OPTIONAL
510 KRB-ERROR ::= [APPLICATION 30] SEQUENCE {
512 msg-type[1] MESSAGE-TYPE,
513 ctime[2] KerberosTime OPTIONAL,
514 cusec[3] krb5int32 OPTIONAL,
515 stime[4] KerberosTime,
517 error-code[6] krb5int32,
518 crealm[7] Realm OPTIONAL,
519 cname[8] PrincipalName OPTIONAL,
520 realm[9] Realm, -- Correct realm
521 sname[10] PrincipalName, -- Correct name
522 e-text[11] GeneralString OPTIONAL,
523 e-data[12] OCTET STRING OPTIONAL
526 ChangePasswdDataMS ::= SEQUENCE {
527 newpasswd[0] OCTET STRING,
528 targname[1] PrincipalName OPTIONAL,
529 targrealm[2] Realm OPTIONAL
532 EtypeList ::= SEQUENCE OF krb5int32
533 -- the client's proposed enctype list in
534 -- decreasing preference order, favorite choice first
536 krb5-pvno krb5int32 ::= 5 -- current Kerberos protocol version number
538 -- transited encodings
540 DOMAIN-X500-COMPRESS krb5int32 ::= 1
542 -- authorization data primitives
544 AD-IF-RELEVANT ::= AuthorizationData
546 AD-KDCIssued ::= SEQUENCE {
547 ad-checksum[0] Checksum,
548 i-realm[1] Realm OPTIONAL,
549 i-sname[2] PrincipalName OPTIONAL,
550 elements[3] AuthorizationData
553 AD-AND-OR ::= SEQUENCE {
554 condition-count[0] INTEGER,
555 elements[1] AuthorizationData
558 AD-MANDATORY-FOR-KDC ::= AuthorizationData
560 -- PA-SAM-RESPONSE-2/PA-SAM-RESPONSE-2
562 PA-SAM-TYPE ::= INTEGER {
563 PA_SAM_TYPE_ENIGMA(1), -- Enigma Logic
564 PA_SAM_TYPE_DIGI_PATH(2), -- Digital Pathways
565 PA_SAM_TYPE_SKEY_K0(3), -- S/key where KDC has key 0
566 PA_SAM_TYPE_SKEY(4), -- Traditional S/Key
567 PA_SAM_TYPE_SECURID(5), -- Security Dynamics
568 PA_SAM_TYPE_CRYPTOCARD(6) -- CRYPTOCard
571 PA-SAM-REDIRECT ::= HostAddresses
573 SAMFlags ::= BIT STRING {
575 send-encrypted-sad(1),
576 must-pk-encrypt-sad(2)
579 PA-SAM-CHALLENGE-2-BODY ::= SEQUENCE {
580 sam-type[0] krb5int32,
581 sam-flags[1] SAMFlags,
582 sam-type-name[2] GeneralString OPTIONAL,
583 sam-track-id[3] GeneralString OPTIONAL,
584 sam-challenge-label[4] GeneralString OPTIONAL,
585 sam-challenge[5] GeneralString OPTIONAL,
586 sam-response-prompt[6] GeneralString OPTIONAL,
587 sam-pk-for-sad[7] EncryptionKey OPTIONAL,
588 sam-nonce[8] krb5int32,
589 sam-etype[9] krb5int32,
593 PA-SAM-CHALLENGE-2 ::= SEQUENCE {
594 sam-body[0] PA-SAM-CHALLENGE-2-BODY,
595 sam-cksum[1] SEQUENCE OF Checksum, -- (1..MAX)
599 PA-SAM-RESPONSE-2 ::= SEQUENCE {
600 sam-type[0] krb5int32,
601 sam-flags[1] SAMFlags,
602 sam-track-id[2] GeneralString OPTIONAL,
603 sam-enc-nonce-or-sad[3] EncryptedData, -- PA-ENC-SAM-RESPONSE-ENC
604 sam-nonce[4] krb5int32,
608 PA-ENC-SAM-RESPONSE-ENC ::= SEQUENCE {
609 sam-nonce[0] krb5int32,
610 sam-sad[1] GeneralString OPTIONAL,
614 PA-S4U2Self ::= SEQUENCE {
615 name[0] PrincipalName,
618 auth[3] GeneralString
621 KRB5SignedPathPrincipals ::= SEQUENCE OF Principal
623 -- never encoded on the wire, just used to checksum over
624 KRB5SignedPathData ::= SEQUENCE {
625 encticket[0] EncTicketPart,
626 delegated[1] KRB5SignedPathPrincipals OPTIONAL
629 KRB5SignedPath ::= SEQUENCE {
630 -- DERcoded KRB5SignedPathData
631 -- krbtgt key (etype), KeyUsage = XXX
634 -- srvs delegated though
635 delegated[2] KRB5SignedPathPrincipals OPTIONAL
638 PA-ClientCanonicalizedNames ::= SEQUENCE{
639 requested-name [0] PrincipalName,
640 mapped-name [1] PrincipalName
643 PA-ClientCanonicalized ::= SEQUENCE {
644 names [0] PA-ClientCanonicalizedNames,
645 canon-checksum [1] Checksum
648 AD-LoginAlias ::= SEQUENCE { -- ad-type number TBD --
649 login-alias [0] PrincipalName,
650 checksum [1] Checksum
654 PA-SvrReferralData ::= SEQUENCE {
655 referred-name [1] PrincipalName OPTIONAL,
656 referred-realm [0] Realm
659 PA-SERVER-REFERRAL-DATA ::= EncryptedData
661 PA-ServerReferralData ::= SEQUENCE {
662 referred-realm [0] Realm OPTIONAL,
663 true-principal-name [1] PrincipalName OPTIONAL,
664 requested-principal-name [2] PrincipalName OPTIONAL,
665 referral-valid-until [3] KerberosTime OPTIONAL,
671 -- etags -r '/\([A-Za-z][-A-Za-z0-9]*\).*::=/\1/' k5.asn1