Bug 301061 - credential caching does not work with the MIT spnego code but does with the included mod_auth_kerb version
credential caching does not work with the MIT spnego code but does with the i...
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: mod_auth_kerb (Show other bugs)
5.0
All Linux
low Severity low
: ---
: ---
Assigned To: Joe Orton
:
Depends On: 314651 319351
Blocks:
  Show dependency treegraph
 
Reported: 2007-09-21 15:03 EDT by Simo Sorce
Modified: 2012-08-31 11:43 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-08-31 11:43:15 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Fix kerberos ticket forwarding (569 bytes, patch)
2007-10-01 16:09 EDT, Rob Crittenden
no flags Details | Diff
Patch against correct version. (569 bytes, patch)
2007-10-01 16:41 EDT, Rob Crittenden
no flags Details | Diff
like Rob's patch, but also checks for GSS_C_DELEG_FLAG in the returned flags set (1.07 KB, patch)
2007-10-01 17:49 EDT, Nalin Dahyabhai
no flags Details | Diff

  None (edit)
Description Simo Sorce 2007-09-21 15:03:42 EDT
Description of problem:
trying to use forwarded tickets with the standard module result in the
application behind it being unable to retrieve the cache with the TGT

This happens with the default compiled MIT libgssapi provide spnego.

mod works fine when compiled using the implementation included whithin the
mod_auth_kerb code.
Comment 3 Rob Crittenden 2007-10-01 16:09:42 EDT
Created attachment 212781 [details]
Fix kerberos ticket forwarding

I tested this with:

<Directory /var/www/cgi-bin>
  AuthType Kerberos
  AuthName "Kerberos Login"
  KrbMethodNegotiate on
  KrbMethodK5Passwd off
  KrbServiceName HTTP
  KrbAuthRealms MYREALM
  Krb5KeyTab /etc/httpd/conf/ipa.keytab
  KrbSaveCredentials on
  Require valid-user
  ErrorDocument 401 /errors/unauthorized.html
</Directory>

And a CGI that looks something like:

#!/bin/sh
echo Content-type: text/plain
echo

if [ -z "$KRB5CCNAME" ]; then
	echo 'Kerberos credential cache name $KRB5CCNAME does not exist.'
	exit 1
fi
/usr/kerberos/bin/klist

You should receive a page back that lists the forwarded ticket.
Comment 4 Rob Crittenden 2007-10-01 16:10:56 EDT
Crud, didn't read the bug closely. I tested this against the Fedora 7 kerberos
implementation.
Comment 5 Rob Crittenden 2007-10-01 16:41:02 EDT
Created attachment 212861 [details]
Patch against correct version.
Comment 6 Nalin Dahyabhai 2007-10-01 17:49:11 EDT
Created attachment 212911 [details]
like Rob's patch, but also checks for GSS_C_DELEG_FLAG in the returned flags set
Comment 8 Rob Crittenden 2007-10-04 14:00:28 EDT
I did all my testing with curl and a python kerberos implementation (PyKerberos
from the Apple calendar project). Testing with Firefox results in no credentials
cached:

[Thu Oct 04 13:57:02 2007] [debug] src/mod_auth_kerb.c(1406): [client
192.168.0.1] kerb_authenticate_user entered with user (NULL) and auth_type Kerberos
[Thu Oct 04 13:57:02 2007] [debug] src/mod_auth_kerb.c(1148): [client
192.168.0.1] Acquiring creds for HTTP@test.example.com
[Thu Oct 04 13:57:02 2007] [debug] src/mod_auth_kerb.c(1241): [client
192.168.0.1] Verifying client data using KRB5 GSS-API
[Thu Oct 04 13:57:02 2007] [debug] src/mod_auth_kerb.c(1257): [client
192.168.0.1] Verification returned code 0
[Thu Oct 04 13:57:02 2007] [debug] src/mod_auth_kerb.c(1275): [client
192.168.0.1] GSS-API token of length 22 bytes will be sent back
[Thu Oct 04 13:57:02 2007] [debug] src/mod_auth_kerb.c(1322): [client
192.168.0.1] set cached name admin@EXAMPLE.COM for connection
[Thu Oct 04 13:57:02 2007] [error] [client 192.168.x.x] Cannot store delegated
credential (gss_krb5_copy_ccache: Invalid credential was supplied (No error))

So the Kerberos connection succeeds but the caching fails.

It does cache the ticket with the mod_auth_kerb internal SPNEGO code.
Comment 9 Nalin Dahyabhai 2007-10-04 14:14:11 EDT
Hmm, I was actually using elinks.  You're sure that firefox has delegation
enabled in addition to negotiate ("network.negotiate-auth.delegation-uris")? 
And just to be sure, that your credentials are forwardable ("klist -f" lists the
"F" flag for the TGT)?
Comment 10 Nalin Dahyabhai 2007-10-04 15:40:35 EDT
Nope, that's a bug alright.  Firefox is sending for-real spnego client packets,
and the gssapi library's getting a little confused trying to save delegated
credentials.
Comment 11 RHEL Product and Program Management 2007-12-03 15:46:30 EST
This request was evaluated by Red Hat Product Management for
inclusion, but this component is not scheduled to be updated in
the current Red Hat Enterprise Linux release.  This request will
be reviewed for a future Red Hat Enterprise Linux release.
Comment 13 RHEL Product and Program Management 2012-04-19 07:47:08 EDT
This request was evaluated by Red Hat Product Management for inclusion
in a Red Hat Enterprise Linux release.  Product Management has
requested further review of this request by Red Hat Engineering, for
potential inclusion in a Red Hat Enterprise Linux release for currently
deployed products.  This request is not yet committed for inclusion in
a release.

Note You need to log in before you can comment on or make changes to this bug.