Bug 319351

Summary: gss_krb5_copy_ccache can't find delegated Kerberos creds when using SPNEGO
Product: Red Hat Enterprise Linux 5 Reporter: Nalin Dahyabhai <nalin>
Component: krb5Assignee: Nalin Dahyabhai <nalin>
Status: CLOSED CURRENTRELEASE QA Contact: Brian Brock <bbrock>
Severity: low Docs Contact:
Priority: urgent    
Version: 5.1CC: jplans, metze
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: GSSApproved
Fixed In Version: 1.6.2-11.fc8 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-02-13 05:06:45 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 301061, 436460    
Attachments:
Description Flags
proposed fix none

Description Nalin Dahyabhai 2007-10-04 22:15:55 UTC 
Description of problem:
The credential handle returned by gss_accept_sec_context() when the client uses
SPNEGO is marked as belonging to the SPNEGO mechanism, so if the calling
application attempts to copy delegated Kerberos 5 credentials into a credential
cache, it'll fail.

Version-Release number of selected component (if applicable):
krb5-1.6.1-17.el5

How reproducible:
Always

Steps to Reproduce:
1. Attempt to delegate credentials to mod_auth_kerb using firefox 2.0.
  
Actual results:
[Thu Oct 04 14:36:34 2007] [error] [client 172.16.80.50] Cannot store delegated
 credential (gss_krb5_copy_ccache: Invalid credential was supplied (No error))

Expected results:
No errors.  Children laughing.  Dancing in the streets.
Comment 1 Nalin Dahyabhai 2007-10-04 22:16:48 UTC 
Created attachment 216591 [details]
proposed fix
Comment 2 RHEL Program Management 2007-10-16 03:36:08 UTC 
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.
Comment 4 Fedora Update System 2007-12-06 17:39:51 UTC 
krb5-1.6.1-6.fc7 has been pushed to the Fedora 7 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update krb5'
Comment 5 Fedora Update System 2007-12-06 20:54:41 UTC 
krb5-1.6.2-11.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update krb5'
Comment 9 Fedora Update System 2008-02-13 05:06:41 UTC 
krb5-1.6.2-11.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2008-02-13 05:15:23 UTC 
krb5-1.6.1-6.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.