Bug 1247606

Summary: [RFE] Add support for multi-hop preauth mechs via |KDC_ERR_MORE_PREAUTH_DATA_REQUIRED| for RFC 6113 ("A Generalized Framework for Kerberos Pre-Authentication")
Product: [Fedora] Fedora Reporter: Roland Mainz <rmainz>
Component: krb5Assignee: Robbie Harwood <rharwood>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 22CC: dpal, kerberos-dev-list, nalin, nathaniel, pkis
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: krb5-1.13-6.fc22 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1247608 (view as bug list) Environment:
Last Closed: 2016-02-08 19:48:55 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1247608    

Description Roland Mainz 2015-07-28 12:23:21 UTC 
[Note this is a dummy bug, the issue has already been fixed in 1.13-6, we're just filing it so we can clone the bug for RHEL7.2]

Description of problem:
RFE: Add support for multi-hop preauth mechs.

In the KDC, allow kdcpreauth modules to return
KDC_ERR_MORE_PREAUTH_DATA_REQUIRED as defined in RFC 6113.

In libkrb5, treat this code like KDC_ERR_PREAUTH_REQUIRED. clpreauth
modules can use the modreq parameter to distinguish between the first
and subsequent KDC messages. We assume that the error padata will
include an element of the preauth mech's type, or at least of a type
recognized by the clpreauth module.

Also reset the list of previously attempted preauth types for both
kinds of errors. That list is really only appropriate for retrying
after a failed preauth attempt, which we don't currently do. Add an
intermediate variable for the reply code to avoid a long conditional
expression.
Comment 1 Roland Mainz 2015-07-28 12:24:53 UTC 
Fixed in krb5-1.13-6.fc22 and rawhide.
Comment 2 Fedora Admin XMLRPC Client 2015-09-01 21:36:03 UTC 
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 4 Robbie Harwood 2016-02-08 19:48:55 UTC 
I believe this has been resolved.  Please reopen if that is not correct.