Description of problem: We'd like for Kerberos clients to be able to access KDCs and password changing services over https proxies, via the [MS-KKDCP] support that's planned for krb5 1.13. If we don't end up jumping to that in the next update, we're going to want to backport it. Version-Release number of selected component (if applicable): krb5-1.11.3-49.el7 How reproducible: Always Steps to Reproduce: 1. Stand up a Windows Server with the KDC Proxy Service running, or a web server with python kdcproxy. 2. Configure /etc/krb5.conf with 'kdc' and 'kpasswd_server' entries only in the form of https URLs and with the server's CA as a trusted anchor, either in the default locations or via explicit configuration. 3. Attempt each of 'kinit' (AS request), 'kvno' (TGS request), and 'kpasswd' (kpasswd request). Actual results: Each fails because the library doesn't know how to even parse HTTPS URLs, much less use them. Expected results: Each should succeed.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2015-0439.html