Description of problem:
KrbLocalUserMapping uses krb5_aname_to_localname() to translate a principal name to a local account name. mod_auth_kerb-5.4-9.el6 has a bug whereby it fails with an Apache HTTP 500 response if the length of the account name greater than or equal to that of the principal name. I'm attaching a patch

Version-Release number of selected component (if applicable):

mod_auth_kerb-5.4-9.el6

How is this reproducible:


Steps to Reproduce:

1. Configure Apache for Negotiate/GSSAPI/Kerberos authentication using mod_auth_kerb, with "KrbLocalUserMapping on".

2. Configure MIT Kerberos to map your client principal name to a local name which is as long or longer than the principal name, e.g. in /etc/krb5.conf:

[realms]

REDHAT.COM = {
  auth_to_local = RULE:[1:$1@$0]s/^you@REDHAT.COM$/somethingevenlonger/
}

Actual results:

Apache responds with an HTTP 500 "internal server" error, with this log message from mod_auth_kerb:

krb5_aname_to_localname() failed: Insufficient space to return complete information

Expected results:

The HTTP request should succeed with "somethingevenlonger" as the REMOTE_USER supplied by mod_auth_kerb.

Additional info:

If the lenght of the translation string is less than that of the principal name, it works. This is because mod_auth_kerb allocates a buffer for the translation based on the length of the client principal name, rather than suing some reasonable independent upper bound (in my patch I used 255 characters).