Question over Kerberos AAA Keytab Encryption type (Client Side Kerb SSO access policy)

Hello!

 

I've got a query for someone familiar with APM and Kerberos encryption types, and SPN Keytabs.

 

I've got a few client side Kerberos SSO APM Access Policies, and I have a question about the keytabs I'm using.

 

We're planning an Active Directory upgrade, which will change the Kerberos tickets issued to our mostly Windows client from RC4 to AES. We're going from AD 2003 to AD 2012. My Kerberos SSO hinges on the Keytabs I have loaded onto the APM for each SPN in AD. They were all created using 'crypto RC4-HMAC-NT'.

 

When my KDC upgrades to 2012, which will result in all my client tickets being AES, will the keytab need to be upgraded to correspond? Or will it continue working as it is?

 

My understanding is that this keytab is used to decrypt incoming kerberos tickets, to confirm their validity. But does it need to be encrypted with the same encryption type used on the incoming tickets? Or am I worrying unnecessarily (likely).

 

All comments and thought gratefully received!

 

Thanks,

 

Gavin Connell-Otten