Bug 671186 - krb5-auth-dialog doesn't start if username != principal name
Summary: krb5-auth-dialog doesn't start if username != principal name
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: krb5-auth-dialog
Version: 6.2
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Debarshi Ray
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-01-20 17:38 UTC by David Jaša
Modified: 2016-10-05 16:35 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-10-05 16:35:15 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description David Jaša 2011-01-20 17:38:01 UTC
Description of problem:
when logged in to machine with Red Hat krb5.conf with username different than kerberos principal name, the krb5-auth-dialog keeps exiting silently until "kinit $principal" is run. Then it works normally until kdestroy is called. Changing "principal" option in preferences has no effect.

Version-Release number of selected component (if applicable):
krb5-auth-dialog-0.13-3.el6.x86_64

How reproducible:
always

Steps to Reproduce:
1. log in as user test
2. run krb5-auth-dialog. It exits immediately with $? = 0
3. run kinit $your_red_hat_nick
4. run krb5-auth-dialog - it works fine
  
Actual results:


Expected results:

If kinit returns "Couldn't acquire kerberos
ticket: 'Client not found in Kerberos database'"
the krb5-auth-dialog should pop up window asking for principal name in addition to password.

Similarly, if there are more realms configured, krb5-auth-dialog should give option which one it should kinit


Additional info:

Comment 2 RHEL Program Management 2011-01-20 18:08:16 UTC
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.

Comment 3 RHEL Program Management 2011-07-06 01:24:02 UTC
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.

Comment 4 Matěj Cepl 2011-10-17 06:19:43 UTC
I could reproduce this on RHEL 6.2 anytime, and in my opinion this is a duplicate of the Fedora bug 672846 -- we are missing -A (or --always) when running krb5-auth-dialog.

Comment 9 Debarshi Ray 2016-10-04 15:33:37 UTC
One downside of using -A or --always is that the user will get a notification about expired network credentials even if they don't intend to use Kerberos at all and just happen to have krb5-auth-dialog installed. You could counter that by saying that the notification can be clicked away using "don't show me this again", or the package can be uninstalled.

Comment 10 Debarshi Ray 2016-10-04 15:35:40 UTC
Here is a scratch build:
https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=11858020

I am slightly concerned whether this change (comment 9) in behaviour is really desired. No strong opinion, though.

Comment 13 Debarshi Ray 2016-10-05 16:02:07 UTC
After talking to Matěj, I am even more inclined to decline this (comment 9). I will reconsider this if there is an actual customer request. Otherwise, it doesn't make sense to tweak the UX with visible side-effects for RHEL 6.x at this stage.

Comment 14 RHEL Program Management 2016-10-05 16:35:15 UTC
Development Management has reviewed and declined this request.
You may appeal this decision by reopening this request.


Note You need to log in before you can comment on or make changes to this bug.