Hi Rob!  

I will defer to you on the Kerberos side of things here...

1) Irrelevant to RHEL, but the 0002 patch includes mutex init for the httpd 1.3.x build using APR functions, which will not work.

2) The mutex handling is not quite correct:

+   tmpnam(client_lock_name);
+   status = apr_global_mutex_create(&client_lock, client_lock_name,
+                                 APR_LOCK_DEFAULT, p);
+   if (status != APR_SUCCESS) {
+      ap_log_error(APLOG_MARK, APLOG_ERR, status, s,
+                  "failed to create lock");
+      return !OK;
+   }
+   apr_pool_cleanup_register(p, NULL, clear_lock, apr_pool_cleanup_null);
    
a) The lockfile name should be configurable, and should default to NULL; APR does not need an actual temp file on most platforms.

b) There is no need for a cleanup here, APR creates one automatically.

c) This code needs to be run only once at startup (post_config runs twice), and needs to set mutex perms correctly too with unixd_set_global_mutex_perms. I'd recommend copying the rewritelock code from mod_rewrite which does all the necessary things.

From upstream ticket ... 

To test the webUI. in the browser URL box enter about:config and edit the line: network.negotiate-auth.delegation.uris and remove the IPA server. That will stop TGT forwarding.

Created attachment 550756 [details]
Patch against mod_auth-kerb-5.4-7

Updated patch based on Joe's comments.

The locking code is now based heavily on the mod_rewrite locking code.

That looks fine.  If the code has actually been copied from mod_rewrite, it should carry the standard ASF licensing header, and we should add a Red Hat copyright notice in there too since there is a bunch of new code.

Created attachment 564008 [details]
Updated patch including spec file changes

The location of the Kerberos libraries changed from /usr/kerberos/lib to /usr/lib

The patch itself is the same currently in Fedora stable.

Created attachment 566921 [details]
Updated patch, no spec

A set of braces was missing around a conditional which would have led to s4u2proxy to always be checked whether enabled or not.

This patch adds the missing braces.

Thanks Rob, package is respun.

Forms based authentication would not work without this functionality:

================ final pass/fail report =================
   Test Date: Tue Apr 17 08:43:20 EDT 2012 
   Total : [9] 
   Passed: [9] 
   Failed: [0] 
   Abort : [0]
   Crash : [0]
---------------------------------------------------------
   [   PASS   ]      forms-cli startup  Check for ipa-server package
   [   PASS   ]      forms-cli-01  Destroy credentials
   [   PASS   ]      forms-cli-02  Ensure that json script does not work without a valid session ID
   [   PASS   ]      forms-cli-03  ensure that you cannot get a valid session id with bad credentials.
   [   PASS   ]      forms-cli-04  attempt to create a new group with bad credentials.
   [   PASS   ]      forms-cli-05  Get a valid session id with good credentials.
   [   PASS   ]      forms-cli-06  Create a new user with the aquired session id. ie, retry forms-cli-02 with valid credentials.
   [   PASS   ]      forms-cli-07  Create a new group with the aquired session id. ie, retry forms-cli-03 with valid credentials.
   [   PASS   ]      forms-cli-08  Delete the group created in the last step using valid credentials in a form.

verified:
ipa-server-2.2.0-9.el6.x86_64
mod_auth_kerb-5.4-9.el6.x86_64

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0877.html