Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 970678 - Document the KrbLocalUserMapping option in README
Summary: Document the KrbLocalUserMapping option in README
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: mod_auth_kerb
Version: 6.4
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Luboš Uhliarik
QA Contact: Filip Holec
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-06-04 14:53 UTC by Jan Pazdziora
Modified: 2021-01-14 09:34 UTC (History)
6 users (show)

Fixed In Version: mod_auth_kerb-5.4-12.el6
Doc Type: Bug Fix
Doc Text:
Clone Of: 970547
Environment:
Last Closed: 2014-10-14 07:44:08 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2014:1557 0 normal SHIPPED_LIVE mod_auth_kerb bug fix update 2014-10-14 01:21:20 UTC

Description Jan Pazdziora 2013-06-04 14:53:58 UTC
+++ This bug was initially created as a clone of Bug #970547 +++

Description of problem:

When you have a web service using normal basic authentication, your logins will look like "alice" and "bob". When you then enable mod_auth_kerb on that httpd server, the logged in user will be "alice@REALM.COM" and "bob@REALM.COM". Which are completely different users in that web application's database so after using SPNEGO, people will not see their data.

It is necessary to use a

   KrbLocalUserMapping On

directive which is undocumented anywhere in the mod_auth_kerb documentation beyond on line in the Changes file in the mod_auth_kerb-5.4.tar.gz:

   *implemented KrbLocalUserMapping i.e. to strip @REALM from username for further use

Version-Release number of selected component (if applicable):

mod_auth_kerb-5.4-9.el6.x86_64

How reproducible:

Deterministic.

Steps to Reproduce:
1. Enable mod_auth_kerb and try the user names not to have the @REALM so that it matches the basic authentication.
2. Try to find the documentation.

Actual results:

You will only find KrbLocalUserMapping (which is what you want) on Stack Overflow.

Expected results:

The directive will also be in /usr/share/doc/mod_auth_kerb-5.4/README.

Additional info:

Basically, please amend the README shipped with the module. Of course, getting it to upstream as well (not just Fedora but module's upstream) would be the best.

Comment 3 RHEL Program Management 2014-03-26 00:19:08 UTC
This request was evaluated by Red Hat Product Management for
inclusion in a Red Hat Enterprise Linux release.  Product
Management has requested further review of this request by
Red Hat Engineering, for potential inclusion in a Red Hat
Enterprise Linux release for currently deployed products.
This request is not yet committed for inclusion in a release.

Comment 9 errata-xmlrpc 2014-10-14 07:44:08 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1557.html


Note You need to log in before you can comment on or make changes to this bug.