Description of problem:

Authentication fails when the client is windows based (IE6 or Firefox), but it
works when using Firefox from RHEL 5 or Debian Etch.

Workstations use pam_krb for login, then use Firefox/Iceweasel clients to access
apache/mod_auth_kerb on RHEL5 box. This works correctly, NegociateAuth works as
it should.

Using the same config server-side, the authentication fails when the client is
on Windows. The same windows client can authentication against an
apache/mod_auth_kerb box running Debian Etch (which uses krb5 1.4.4).

The error message is:

[Mon Apr 30 16:27:56 2007] [debug] src/mod_auth_kerb.c(1432): [client
192.168.0.10] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Mon Apr 30 16:27:57 2007] [debug] src/mod_auth_kerb.c(1432): [client
192.168.0.10] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Mon Apr 30 16:27:57 2007] [debug] src/mod_auth_kerb.c(1147): [client
192.168.0.10] Acquiring creds for HTTP
[Mon Apr 30 16:27:57 2007] [debug] src/mod_auth_kerb.c(1266): [client
192.168.0.10] Verifying client data using KRB5 GSS-API
[Mon Apr 30 16:27:57 2007] [debug] src/mod_auth_kerb.c(1282): [client
192.168.0.10] Verification returned code 851968
[Mon Apr 30 16:27:57 2007] [error] [client 192.168.0.10]
gss_accept_sec_context() failed: Unspecified GSS failure.  Minor code may
provide more information (Cannot allocate memory)

Debugging httpd in gdb and tracing function calls leads to the file
indicate_mechs.c where gss_int_copy_oid_set() is called.

This function returns 0 on success, but in indicate_mechs.c the function is
called inside a if(), where, if the result is zero, it fails.

Looking at upstream mit release (1.5.3), the test isn't the same as the one in
RHEL5 release. If I correct the test in indicate_mechs.c, everything works as it
should.

The diff between upstream release (1.5.3) and red hat release (1.5-7) is attached.

If I can add anything to help more, please ask.

Regards,
-- Yves-Alexis Perez