Bug 1020087

Description of problem:

In domain .company.com, there is company-wide configured Kerberos infrastructure with realm COMPANY.COM. Furthermore, for testing purposes I've set up an IPA server ipa.dom1.company.com with realm EXAMPLE.COM and http server www.dom2.company.com, configured with mod_auth_kerb with keytab for service principal HTTP/www.dom2.company.com.

When I kinit as user, authentication works. When however I kdestroy -A and kinit with just user (and no ticket @EXAMPLE.COM), access from Firefox 24 (Fedora 19) to the protected location of http server www.dom2.company.com yields 500 Internal Server Error and message

gss_display_name() failed: A required input parameter could not be read: An in
valid name was supplied (, Unknown error)

in the error_log.

Version-Release number of selected component (if applicable):

# rpm -q httpd mod_auth_kerb
httpd-2.2.15-26.el6.x86_64
mod_auth_kerb-5.4-9.el6.x86_64

How reproducible:

Deterministic on RHEL 6 and Fedora 19.

Steps to Reproduce:
1. Install the http server and mod_auth_kerb:
# yum install -y mod_auth_kerb
2. Get keytab for the service principal -- on IPA-enrolled client, something like:
# ipa-getkeytab -s ipa.example.com -k /etc/http.keytab -p HTTP/$( hostname )
# chown apache /etc/http.keytab
# chmod 600 /etc/http.keytab
3. Configure the mod_auth_kerb (in file like /etc/httpd/conf.d/auth_kerb.conf):
 <Location /private>
 AuthType Kerberos
 AuthName "Kerberos Login"
 KrbMethodNegotiate On
 KrbMethodK5Passwd Off
 KrbAuthRealms EXAMPLE.COM
 Krb5KeyTab /etc/http.keytab
 KrbLocalUserMapping On
 require valid-user
 </Location>
4. Create the protected content:
# echo OK > /var/www/html/private
5. Start the httpd server:
# service httpd restart
7. On a client machine, make sure Firefox is configured allow SPNEGO with the http server -- in about:config, network.negotiate-auth.trusted-uris should have .company.com if the server is in .company.com domain.
6. On a client machine, clear any tickets:
$ kdestroy -A
7. Try that protection works -- access http://<the-httpd-fqdn>/private URL from Firefox on the client machine -- expect to get 401 Unauthorized.
8. Obtain correct ticket:
$ kinit user
7. Try that authentication works -- access http://<the-httpd-fqdn>/private URL from Firefox on the client machine -- expect to get 200 and see "OK".
9. Purge tickets:
$ kdestroy -A
10. Get ticket from different realm:
$ kinit user
11. Access http://<the-httpd-fqdn>/private URL from Firefox on the client machine.

Actual results:

500 Internal Server Error and in the error_log on the server

gss_display_name() failed: A required input parameter could not be read: An in
valid name was supplied (, Unknown error)

Expected results:

401 Unauthorized or some other status except 500.

Additional info:

Please note that you have to use Firefox to reproduce the issue as the 500 is a result of second HTTP request that Firefox does after the initial 401 response. Neither curl nor LWP do the retry so they cannot be used to test the problem.

Simo suggests

  this could be the IAKERB module trying to get a ticket through
  the server. mod_auth_kerb should intercept this error and return an
  unauthorized header rather than a 500

and

  It's an error condition that is not being properly handled in
  any case, whether the client is right or wrong in what it is doing
  mod_auth_kerb shouldn't throw up like that, it should just log and
  return a 400.