Bug 1343361
| Summary: | SASL GSSAPI authentication is broken on spice-gtk | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Fabiano Fidêncio <fidencio> | ||||
| Component: | spice-gtk | Assignee: | Pavel Grunt <pgrunt> | ||||
| Status: | CLOSED ERRATA | QA Contact: | SPICE QE bug list <spice-qe-bugs> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 7.3 | CC: | abokovoy, dblechte, djasa, pgrunt, rbalakri, tpelka | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | spice-gtk-0.31-4.el7 | Doc Type: | Bug Fix | ||||
| Doc Text: |
Cause: spice-gtk is not trying to authenticate when an username is missing
Consequence: it is not possible to authenticate if the username is not required
Fix: Allow to authenticate when the username is not specified
Result: SASL GSSAPI authentication works
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2016-11-04 01:21:12 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Fabiano Fidêncio
2016-06-07 08:25:00 UTC
Fixed upstream: https://cgit.freedesktop.org/spice/spice-gtk/commit/?id=fb8e51667b9fa63497e413fb4fd484d23b772788 The current build keeps asking password even though it contains the patch and the program goes through the lines added. So the patch is in but the bug is not fixed yet. When accessing VNC server of the same VM, I'm getting esesntially the same disconnection: (remote-viewer:31390): GSpice-DEBUG: spice-channel.c:1584 main-1:0: Client start negotiation mechlist 'GSS-SPNEGO,GSSAPI,DIGEST-MD5' (remote-viewer:31390): GSpice-DEBUG: spice-channel.c:1413 main-1:0: Filled SASL interact (remote-viewer:31390): GSpice-DEBUG: spice-channel.c:1584 main-1:0: Client start negotiation mechlist 'GSS-SPNEGO,GSSAPI,DIGEST-MD5' (remote-viewer:31390): GSpice-DEBUG: spice-channel.c:1607 main-1:0: Server start negotiation with mech GSS-SPNEGO. Data 1243 bytes 0xad1920 '`\x82\u0004\xd7\u0006\u0006+\u0006\u0001\u0005\u0005\u0002\xa0\x82\u0004\xcb0\x82\u0004Ǡ\u000d0\u000b\u0006 *\x86H\x86\xf7\u0012\u0001\u0002\u0002\xa2\x82\u0004\xb4\u0004\x82\u0004\xb0`\x82\u0004\xac\u0006 *\x86H\x86\xf7\u0012\u0001\u0002\u0002\u0001' (remote-viewer:31390): GSpice-DEBUG: spice-channel.c:1633 main-1:0: Getting sever start negotiation reply (remote-viewer:31390): GSpice-DEBUG: spice-channel.c:995 main-1:0: Closing the connection: spice_channel_read() - ret=0 (remote-viewer:31390): GSpice-DEBUG: spice-channel.c:2569 main-1:0: Coroutine exit main-1:0 (remote-viewer:31390): GSpice-DEBUG: spice-channel.c:2776 main-1:0: reset (remote-viewer:31390): GSpice-DEBUG: channel-main.c:1582 agent connected: no (remote-viewer:31390): GSpice-DEBUG: spice-channel.c:2704 main-1:0: channel reset Can somebody see if it is configuration issue on my side or that the bug is not fixed yet? Wrong paste in previous comment, corect paste for VNC is: (remote-viewer:16272): gtk-vnc-DEBUG: vncconnection.c Client start negotiation mechlist 'GSS-SPNEGO,GSSAPI,DIGEST-MD5' (remote-viewer:16272): gtk-vnc-DEBUG: vncconnection.c Server start negotiation with mech GSS-SPNEGO. Data 693 bytes 0xb618f0 '`\x82\u0002\xb1\u0006\u0006+\u0006\u0001\u0005\u0005\u0002\xa0\x82\u0002\xa50\x82\u0002\xa1\xa0\u000d0\u000b\u0006 *\x86H\x86\xf7\u0012\u0001\u0002\u0002\xa2\x82\u0002\x8e\u0004\x82\u0002\x8a`\x82\u0002\x86\u0006 *\x86H\x86\xf7\u0012\u0001\u0002\u0002\u0001' (remote-viewer:16272): gtk-vnc-DEBUG: vncconnection.c Getting sever start negotiation reply (remote-viewer:16272): gtk-vnc-DEBUG: vncconnection.c Read error Resource temporarily unavailable Created attachment 1205171 [details]
spice-gtk SASL2 log
So the problem was in in my configuration. Contrary to info in [1], the sasl2 configuration file for qemu + vnc/spice on RHEL 7 is /etc/sasl2/qemu.conf. Once there, both VNC and Spice work correctly with sasl/gssapi (see attachment for successfull SASL authentication log)
(In reply to David Jaša from comment #10) > Created attachment 1205171 [details] > spice-gtk SASL2 log > > So the problem was in in my configuration. Contrary to info in [1], the > sasl2 configuration file for qemu + vnc/spice on RHEL 7 is > /etc/sasl2/qemu.conf. Once there, both VNC and Spice work correctly with > sasl/gssapi (see attachment for successfull SASL authentication log) The article you reference was tested with Fedora: "It is matter of setting appropriate configuration variables in /etc/libvirt/libvirtd.conf and /etc/libvirt/qemu.conf, and tuning /etc/sasl2/libvirt.conf and /etc/sasl2/qemu.conf to allow SASL GSSAPI authentication." The article also references a third-party provided HOWTO on freeipa.org, http://www.freeipa.org/page/Libvirt_with_VNC_Consoles. The howto talks about /etc/sasl2/qemu-kvm.conf and /etc/sasl2/spice.conf. I believe these were the files in RHEL7.0 which later were moved to the current location. FreeIPA team does not curate HOWTOs provided by third parties. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2229.html |