Bug 951965
| Summary: | PAC is not recognized in krb5 1.10 KDC at TGS-REQ from krb5-1.11 client | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Sumit Bose <sbose> |
| Component: | krb5 | Assignee: | Nalin Dahyabhai <nalin> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 6.4 | CC: | abokovoy, dpal, ebenes, ekeck, jplans, ksrot, mkosek, nalin, nathaniel, nsoman, pkis, sbose, snagar |
| Target Milestone: | rc | Keywords: | ZStream |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | krb5-1.10.3-14.el6 | Doc Type: | Bug Fix |
| Doc Text: |
* When processing client requests transmitted to it using the flexible authentication secure tunneling (FAST) facility, the KDC would lose track of the type of the request that the client supplied, potentially causing it to fail to include authorization data in the ticket it would later issue in response to the request. In some environments, this would result in authorization to resources being incorrectly denied. This update sets the msg_type option when decoding FAST requests, and access control no longer fails in the described scenario.
|
Story Points: | --- |
| Clone Of: | 951964 | Environment: | |
| Last Closed: | 2013-11-14 10:48:18 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 951843, 951964 | ||
| Bug Blocks: | 1002179 | ||
|
Description
Sumit Bose
2013-04-14 21:09:33 UTC
Hi Sumit, Nalin, any thoughts how to reproduce this easily? Can it be done without AD just with a MIT kdc? There is a possibility to test against AD, but the proffered way is without it. Thanks, Patrik Hi Sumit, Could you please give more detail about the issue reproduction? Do we really need to have IPA and AD or is there a simpler way? Thanks, Patrik Yes, you need IPA to reproduce the issue because default MIT KDC driver does not deal with MS-PAC. (In reply to Alexander Bokovoy from comment #9) > Yes, you need IPA to reproduce the issue because default MIT KDC driver does > not deal with MS-PAC. I'm confused, doesn't IPA use mit kdc? Yes, and it uses its own database backend which implements MS-PAC handling. MIT KDC has pluggable database backends. (In reply to Alexander Bokovoy from comment #11) > Yes, and it uses its own database backend which implements MS-PAC handling. > MIT KDC has pluggable database backends. I see. And could you describe the reproduction scenario in more details, please? From the original description it is not clear to me what and how to configure to see the error. Thanks you in advance. I think the easiest way would be for you to work with Martin (added to CC:) who can provide you a pre-built IPA environment with trust to AD. Once environment is there, all you need to do is following: 0. kdestroy 1. kinit admin 2. ls -la /`klist | grep cache | cut -d':' -f2-|cut -d/ -f2-` 3. kvno cifs/`hostname` 4. ls -la /`klist | grep cache | cut -d':' -f2-|cut -d/ -f2-` The result should look like this: [root@master ~]# kinit admin Password for admin: [root@master ~]# ls -la /`klist | grep cache | cut -d':' -f2-|cut -d/ -f2-` -rw-------. 1 root root 1372 Jul 25 16:18 /run/user/0/krb5cc/tktVtEKRi [root@master ~]# kvno cifs/`hostname` cifs/master.lvee.ipa: kvno = 1 [root@master ~]# ls -la /`klist | grep cache | cut -d':' -f2-|cut -d/ -f2-` -rw-------. 1 root root 2401 Jul 25 16:18 /run/user/0/krb5cc/tktVtEKRi Note the sizes of the credentials cache -- first step is the ccache with TGT. If it has MS-PAC, it should be bigger than 1Kb. Second size is ccache with TGT and a ticket to cifs service. If the ticket has MS-PAC attached, it should be roughly a 1Kb size and definitely not around 500 bytes or so. In result, a second size of the ccache should be about twice the original size. Yes, if needed I can provide one-time testing environment or instructions for you how to create it yourselves. (In reply to Martin Kosek from comment #14) > Yes, if needed I can provide one-time testing environment or instructions > for you how to create it yourselves. Great! I prefer instructions to create test env. I think the best instructions on connecting IPA and AD are available on freeipa.org wiki: http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup ... or RHEL docs: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/active-directory-trust.html |