Bug 1185917 - GSSAPI in IBM JDK 7 strips square brackets from IPv6 SPNs
Summary: GSSAPI in IBM JDK 7 strips square brackets from IPv6 SPNs
Keywords:
Status: CLOSED EOL
Alias: None
Product: JBoss Enterprise Application Platform 6
Classification: JBoss
Component: Security
Version: 6.4.0
Hardware: Unspecified
OS: Unspecified
unspecified
medium
Target Milestone: ---
: ---
Assignee: Darran Lofthouse
QA Contact: Pavel Slavicek
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-01-26 15:53 UTC by Josef Cacek
Modified: 2019-08-19 12:44 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2019-08-19 12:44:36 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1189141 0 unspecified CLOSED Clean-up tests which use Kerberos in the EAP testsuite 2021-02-22 00:41:40 UTC
Red Hat Bugzilla 1266482 0 unspecified CLOSED [QE] Skip Kerberos tests in IPv6 environments when hostname is not configured 2021-02-22 00:41:40 UTC

Internal Links: 1189141 1266482

Description Josef Cacek 2015-01-26 15:53:47 UTC 
If a Java client does the kerberos authentication to EAP and the HTTP SPN contains IPv6 address, then authentication fails because IBM implementation of JGSSAPI strips square brackets from the SPN.

e.g. server name is initialized to "HTTP/[2620:52:0:2804:2430:ba4:52c6:8453]" in the client, but during GSSContext.initSecContex(...) it's changed to "HTTP/2620:52:0:2804:2430:ba4:52c6:8453"

The problem comes from a method Krb5Name.getHostBasedNameString(), which is called from:
  com.ibm.security.jgss.mech.krb5.Krb5Name.canonicalize
  com.ibm.security.jgss.mech.krb5.Krb5Name.init (Krb5Name.java:260)
  com.ibm.security.jgss.mech.krb5.Krb5Name.<init> (Krb5Name.java:265)
  com.ibm.security.jgss.mech.krb5.Krb5MechFactory.getNameElement (Krb5MechFactory.java:155)
  com.ibm.security.jgss.GSSManagerImpl.createMechName (GSSManagerImpl.java:262)
  com.ibm.security.jgss.GSSNameImpl.createMechName (GSSNameImpl.java:549)
  com.ibm.security.jgss.GSSNameImpl.canonicalize (GSSNameImpl.java:275)
  com.ibm.security.jgss.mech.spnego.SPNEGOContext.createContext (SPNEGOContext.java:964)
  com.ibm.security.jgss.mech.spnego.SPNEGOContext.getPreferredMech (SPNEGOContext.java:1,185)
  com.ibm.security.jgss.mech.spnego.SPNEGOContext.createInitToken (SPNEGOContext.java:1,132)
  com.ibm.security.jgss.mech.spnego.SPNEGOContext.initSecContext (SPNEGOContext.java:529)
  com.ibm.security.jgss.GSSContextImpl.initSecContext (GSSContextImpl.java:382)
  com.ibm.security.jgss.GSSContextImpl.initSecContext (GSSContextImpl.java:331)

Workaround:
Use Oracle JDK or OpenJDK on the client.

This issue doesn't root in EAP, but we hit this with EAP testsuite in tests which employs Kerberos authentication.
Note You need to log in before you can comment on or make changes to this bug.