Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1228228

Summary: Attribute for-hosts for Security Realm with Kerberos does not select keytab in defined order
Product: [JBoss] JBoss Enterprise Application Platform 6 Reporter: Ondrej Lukas <olukas>
Component: Domain ManagementAssignee: Tomas Hofman <thofman>
Status: CLOSED WONTFIX QA Contact: Ondrej Lukas <olukas>
Severity: low Docs Contact:
Priority: unspecified    
Version: 6.4.0CC: brian.stansberry, dandread, darran.lofthouse, thofman
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-08-28 08:14:44 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Ondrej Lukas 2015-06-04 12:42:17 UTC
Attribute for-hosts for Security realm with Kerberos does not select keytab in order which is described in $EAP_SERVER/docs/schema/jboss-as-config_1_7.xsd (begin on line 456). 

According to this XSD hostname values from for-hosts attributes (steps 1. nad 2.) are iterated before values obtained from principal (steps 3. and 4.). In case when keytab element (denote as keytab1) contains for-hosts attribute with hostname EXAMPLE and some another keytab element (denote as keytab2) contains principal HTTP/EXAMPLE then keytab2 is selected instead of keytab1. It means step 3. is performed before step 2. 

Configuration for mentioned above example:
<server-identities>
    <kerberos>
        <keytab principal="HTTP/ANYVALUE" path="/path/to/krb1.keytab" for-hosts="EXAMPLE"/>
        <keytab principal="HTTP/EXAMPLE" path="/path/to/krb2.keytab" for-hosts="SOMEHOST"/>
    </kerberos>
</server-identities>

In case when hostname in for-hosts contains also protocol (HTTP/EXAMPLE instead of EXAMPLE) then it works correctly.

Comment 1 Darran Lofthouse 2015-07-14 14:31:08 UTC
As this has no customer case it may make more sense to just update the documentation to reflect the true resolution.

The problem here is that the fix is a change in behaviour, customers may inadvertently already be depending on that behaviour and an existing installation broken for the sake of a bug fix not requested by any other customer.

Comment 2 Tomas Hofman 2015-07-22 07:39:02 UTC
Suggesting adding this to know issues. Upstream fix is waiting for merge.