Bug 767537

Summary:	openjdk does not include fix from oracle, needed for Windows kerberos interoparability
Product:	Red Hat Enterprise Linux 6	Reporter:	Olaf Flebbe <o.flebbe>
Component:	java-1.6.0-openjdk	Assignee:	Deepak Bhole <dbhole>
Status:	CLOSED ERRATA	QA Contact:	David Kutálek <dkutalek>
Severity:	high	Docs Contact:
Priority:	high
Version:	6.3	CC:	cww, psplicha
Target Milestone:	rc	Keywords:	ZStream
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-20 13:51:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	727267, 800269

Description Olaf Flebbe 2011-12-14 10:27:16 UTC

Description of problem:

Channel Binding for the Kerberos Protocol is implemented incorrectly, causing interopability problems with Windows Server 2008/Internet Explorer.

Version-Release number of selected component (if applicable):

java-1.6.0-openjdk-1.6.0.0-1.41.1.10.4

Oracle has released a patch to this problem, but it is not included in openjdk as provided by Redhat.


How reproducible:

* Setup a AD Domain with W2K8

* Microsoft IE patch KB974455 enabled "Extended Protection" for Integrated Windows Authentication is installed (default now!)

* Add RHEL6 Client to AD Domain 

* Install tomcat and for instance spnego.sf.net and configure a Web Kerberos SSO  (or CAS from jasig or shibboleth from internet2.org )

* Use the Internet Explorer to authenticate a websession 

* You get this java exception.

GSSException: Channel binding mismatch (Mechanism level: ChannelBinding not provided!)

 
More and background information is provided in ticket 
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=830

Additional info:

Please add the patch which is provided in the icedtea bugzilla to openjdk.

Comment 3 Deepak Bhole 2011-12-19 20:26:22 UTC

I have requested a backport upstream:

http://mail.openjdk.java.net/pipermail/jdk6-dev/2011-December/002602.html

Once there, I will request for IcedTea and we can then do RHEL builds.

Comment 9 errata-xmlrpc 2012-06-20 13:51:19 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0836.html