Hide Forgot
Description of problem: python-kerberos 1.1 includes an off-by-one bug, with the result that it incorrectly encodes the Kerberos username into a GSSAPI message and authentication always fails. The bug was reported and fixed upstream: http://trac.calendarserver.org/ticket/355 Version-Release number of selected component (if applicable): 1.1 How reproducible: Always. Additional info: Remove the " + 1" from the end of line 358 in python-kerberos-1.1/src/kerberosgss.c and rebuild python-kerberos. Authentication now succeeds. This is the fix to issue 355 upstream: http://trac.calendarserver.org/ticket/355 http://trac.calendarserver.org/changeset?reponame=&new=4895%40PyKerberos%2Ftrunk&old=4241%40PyKerberos%2Ftrunk
Discovered via this PyMongo bug report: https://jira.mongodb.org/browse/PYTHON-626
Created attachment 861987 [details] demonstration program You need a Kerberos server to test against. I tested with IPA using this: # ipa-server-install ... # kinit admin # ipa service-add test/`hostname` --force # ipa-getkeytab -s `hostname` -p test/`hostname` -k test.keytab # export KRB5_KTNAME=`pwd`/test.keytab # python wrap.py Prior to the fix the response is `admin@EXAMPLE.COM\x00' and with the fix just 'admin@EXAMPLE.COM' where EXAMPLE.COM is your Kerberos realm.
Verified using ipa-server-3.0.0-42.el6.x86_64, python-kerberos-1.1-7.el6.x86_64 Took steps as recommended above: # kinit admin Password for admin@TESTRELM.TEST: # ipa service-add test/`hostname` --force ---------------------------------------------------------- Added service "test/idm-qe-03.testrelm.test@TESTRELM.TEST" ---------------------------------------------------------- Principal: test/idm-qe-03.testrelm.test@TESTRELM.TEST Managed by: idm-qe-03.testrelm.test # ipa-getkeytab -s `hostname` -p test/`hostname` -k test.keytab Keytab successfully retrieved and stored in: test.keytab # export KRB5_KTNAME=`pwd`/test.keytab # vim wrap.py [Updated service = "test@idm-qe-03.testrelm.test" ] # python wrap.py User 'admin@TESTRELM.TEST'
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2014-1600.html