Bug 1247606 - [RFE] Add support for multi-hop preauth mechs via |KDC_ERR_MORE_PREAUTH_DATA_REQUIRED| for RFC 6113 ("A Generalized Framework for Kerberos Pre-Authentication")
Summary: [RFE] Add support for multi-hop preauth mechs via |KDC_ERR_MORE_PREAUTH_DATA_...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: krb5
Version: 22
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Robbie Harwood
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1247608
TreeView+ depends on / blocked
 
Reported: 2015-07-28 12:23 UTC by Roland Mainz
Modified: 2016-02-08 19:48 UTC (History)
5 users (show)

Fixed In Version: krb5-1.13-6.fc22
Clone Of:
: 1247608 (view as bug list)
Environment:
Last Closed: 2016-02-08 19:48:55 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Roland Mainz 2015-07-28 12:23:21 UTC
[Note this is a dummy bug, the issue has already been fixed in 1.13-6, we're just filing it so we can clone the bug for RHEL7.2]

Description of problem:
RFE: Add support for multi-hop preauth mechs.

In the KDC, allow kdcpreauth modules to return
KDC_ERR_MORE_PREAUTH_DATA_REQUIRED as defined in RFC 6113.

In libkrb5, treat this code like KDC_ERR_PREAUTH_REQUIRED. clpreauth
modules can use the modreq parameter to distinguish between the first
and subsequent KDC messages. We assume that the error padata will
include an element of the preauth mech's type, or at least of a type
recognized by the clpreauth module.

Also reset the list of previously attempted preauth types for both
kinds of errors. That list is really only appropriate for retrying
after a failed preauth attempt, which we don't currently do. Add an
intermediate variable for the reply code to avoid a long conditional
expression.

Comment 1 Roland Mainz 2015-07-28 12:24:53 UTC
Fixed in krb5-1.13-6.fc22 and rawhide.

Comment 2 Fedora Admin XMLRPC Client 2015-09-01 21:36:03 UTC
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

Comment 4 Robbie Harwood 2016-02-08 19:48:55 UTC
I believe this has been resolved.  Please reopen if that is not correct.


Note You need to log in before you can comment on or make changes to this bug.