Cause:
Windows servers do not allow seal/sign when over TLS, so we need a way to indicate not to negotiate them. While setting maxssf=0 works for GSSAPI, it doesn't for GSS-SPENGO.
Consequence:
Authentication against Windows services over a TLS channel and using the GSs-SPNEGO SASL mechanism can fail.
Fix:
Add support in cyrus-sasl to correctly handle maxssf=0 which will allow GSS-SPNEGO authentication to complete without failing.
Result:
Authentication against Windows Servers with GSS-SPNEGO over a TLS channel now works correctly.
Description of problem:
Windows servers do not allow seal/sign when over TLS, so we need a way to indicate not to negotiate them. While setting maxssf=0 works for GSSAPI, it doesn't for GSS-SPENGO.
How reproducible:
ldapsearch -h adc.acme.com -b dc=acme,dc=com cn=isaac -Y "GSS-SPNEGO" -N -ZZ -O
maxssf=0
Additional info:
Simo had posted a wip patch on the team list (works for me).
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (Moderate: cyrus-sasl security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHSA-2020:4497