Bug 1247608

Summary:	[RFE] Add support for multi-hop preauth mechs via \|KDC_ERR_MORE_PREAUTH_DATA_REQUIRED\| for RFC 6113 ("A Generalized Framework for Kerberos Pre-Authentication")
Product:	Red Hat Enterprise Linux 7	Reporter:	Roland Mainz <rmainz>
Component:	krb5	Assignee:	Robbie Harwood <rharwood>
Status:	CLOSED ERRATA	QA Contact:	Patrik Kis <pkis>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.2	CC:	dpal, extras-qa, nalin, nathaniel, npmccallum, pkis, sbose, spoore
Target Milestone:	rc	Keywords:	FutureFeature
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	krb5-1.13.2-4.el7	Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:	1247606	Environment:
Last Closed:	2015-11-19 05:13:53 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1247606
Bug Blocks:	1203889

Description Roland Mainz 2015-07-28 12:26:33 UTC

+++ This bug was initially created as a clone of Bug #1247606 +++

[Note this is a dummy bug, the issue has already been fixed in 1.13-6, we're just filing it so we can clone the bug for RHEL7.2]

Description of problem:
RFE: Add support for multi-hop preauth mechs.

In the KDC, allow kdcpreauth modules to return
KDC_ERR_MORE_PREAUTH_DATA_REQUIRED as defined in RFC 6113.

In libkrb5, treat this code like KDC_ERR_PREAUTH_REQUIRED. clpreauth
modules can use the modreq parameter to distinguish between the first
and subsequent KDC messages. We assume that the error padata will
include an element of the preauth mech's type, or at least of a type
recognized by the clpreauth module.

Also reset the list of previously attempted preauth types for both
kinds of errors. That list is really only appropriate for retrying
after a failed preauth attempt, which we don't currently do. Add an
intermediate variable for the reply code to avoid a long conditional
expression.

--- Additional comment from Roland Mainz on 2015-07-28 08:24:53 EDT ---

Fixed in krb5-1.13-6.fc22 and rawhide.

Comment 1 Nathaniel McCallum 2015-07-28 19:32:26 UTC

QA should be sanity only.

Comment 2 Nathaniel McCallum 2015-07-28 20:34:35 UTC

FYI, this patch is low risk and addresses standards compliance. In particular, client support for this error code will be used in a feature we are developing currently.

Comment 3 Patrik Kis 2015-07-29 08:27:26 UTC

(In reply to Nathaniel McCallum from comment #2)
> FYI, this patch is low risk and addresses standards compliance. In
> particular, client support for this error code will be used in a feature we
> are developing currently.

Thanks for the extra explanation.

Comment 4 Roland Mainz 2015-07-29 15:02:14 UTC

Fix checked in (krb5-1.13.2-4.el7) ...

... marking bug as MODIFIED.

Comment 10 errata-xmlrpc 2015-11-19 05:13:53 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2154.html