Bug 1102586

Its near sure problem in our test.

This is fixed in ER2 because we have mod_auth_kerb-eap6 on EL7 now, and correctly requires httpd22.

The previous error was indeed caused by problem with test, however I am still unable to get kerberos authentication working. I get the following error in httpd/logs/error_log
[Tue Jun 10 10:10:34 2014] [debug] src/mod_auth_kerb.c(1938): [client 127.0.0.1] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Tue Jun 10 10:10:34 2014] [debug] src/mod_auth_kerb.c(1938): [client 127.0.0.1] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Tue Jun 10 10:10:34 2014] [debug] src/mod_auth_kerb.c(1279): [client 127.0.0.1] Acquiring creds for HTTP@localhost
[Tue Jun 10 10:10:34 2014] [debug] src/mod_auth_kerb.c(1139): [client 127.0.0.1] GSS-API major_status:00020000, minor_status:0000000d
[Tue Jun 10 10:10:34 2014] [error] [client 127.0.0.1] gss_acquire_cred() failed: An invalid name was supplied (, Permission denied)



FYI the kerberos server used (ApacheDS) produces the following error:
[10:10:34] WARN [org.apache.directory.server.kerberos.protocol.KerberosProtocolHandler] - KDC cannot accommodate requested option (13)
[10:10:34] WARN [org.apache.directory.server.KERBEROS_LOG] - KDC cannot accommodate requested option (13)



httpd was accessed with the following command:
curl -v --negotiate -u : http://localhost//kerberostest/auth_kerb_page.html



/etc/krb5.conf:
[logging]
  default = FILE:/var/log/krb5libs.log
  kdc = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmind.log
[libdefaults]
  default_realm = EXAMPLE.COM
  default_tgs_enctypes = des-cbc-md5,des3-cbc-sha1-kd
  default_tkt_enctypes = des-cbc-md5,des3-cbc-sha1-kd
  dns_lookup_realm = false
  dns_lookup_kdc = false
  allow_weak_crypto = yes
  ticket_lifetime = 24h
  renew_lifetime = 7d
  forwardable = yes  
[realms]
  EXAMPLE.COM = {
    kdc = localhost:60088
    admin_server = localhost:60088
  }
[domain_realm]
  .example.com = EXAMPLE.COM
  example.com = EXAMPLE.COM



jboss-ews-2.1/httpd/conf.d/auth_kerb.conf:
#
# The mod_auth_kerb module implements Kerberos authentication over
# HTTP, following the "Negotiate" protocol.
# 
LoadModule auth_kerb_module modules/mod_auth_kerb.so
#
# Sample configuration: Kerberos authentication must only be
# used over SSL to prevent replay attacks.  The keytab file
# configured must be readable only by the "apache" user, and
# must contain service keys for "HTTP/www.example.com", where
# "www.example.com" is the FQDN of this server.
#
<Location /kerberostest>
#  SSLRequireSSL
  AuthType Kerberos
  AuthName "Kerberos Login"
  KrbMethodNegotiate On
  KrbMethodK5Passwd Off
  KrbAuthRealms EXAMPLE.COM
  KrbServiceName HTTP
  Krb5KeyTab /etc/httpd22/krb5.keytab
  require valid-user
</Location>



I searched and googled, but couldn't find any help/solution. Maybe someone with more experience might be able to help out?

Can this have anything in common with the updated APR version in RHEL7?

A problem was found in our test automation.
FYI it was caused by RHEL7 root uname (0077) which prevents reading newly files created by root.