Error using GSS-API on Solaris 9 Platform
Ahluwalia, Ish
iahluwalia at sonusnet.com
Mon Aug 23 18:44:43 EDT 2004
Hi All:
I'm a newbie to Kerberos world and this is my first time using GSS-API ever. I'm trying to use GSS-API on Solaris 9 platform. From what I have read so far, it seems like there is no need to install the MIT version of Kerberos on Solaris since SUN is fully compatible with it. While writing a program and using GSS-API, I'm getting the following Major and Minor errors:
********Errors******************
GSS-API error: acquiring credentials: Major Error: No credentials were supplied, or the credentials were unavailable or inaccessible
GSS-API error: acquiring credentials: Minor Error: mech_dh: Success
Acquiring credentials - Maj Stat: 458752 Min Stat: 0
***********Error End*************************************
I'm using the following GSS-API call and the at the completion of the call I get the above major and minor errors.
maj_stat = gss_acquire_cred(&min_stat, server_name, 0,
desiredMechs, GSS_C_ACCEPT,
server_cred, NULL, NULL);
I'm acting as Kerberos Service which will only accept Contexts. I beleive I have my krb5.conf properly setup and also KDC is running on a different machine The way I understand GSS-API and Solaris, I don't need to construct mechanism OIDs since by default Kerberos V5 is the default mechanism of GSS-API. So, I'm using the default mechanism by specifying "GSS_C_NULL_OID" for the desired mechanism. I get the above mentioned errors. The minor error contains a text "mech_dh" which caught my eye and didn't seem right. I further explored to find what other mechanisms are supported and found a solaris mechanism file. The mechanism file contians Diffe-Hielleman and Kerberos_v5 as the supported mechanism. As per GSS-API IETF RFC, kerberos_v5 is the default mechanism for GSS-API. So, I assumed may be Diffe-Hielmman is the default mechanism for some reason on Solaris.
So, just to be sure, I constructed my own mechanism OID using kerberos_v5 as mechanism type and tried the same thing - but got the following results:
********** Error******************************************
GSS-API error: acquiring credentials: Major Error: Unspecified GSS failure. Minor code may provide more information
GSS-API error: acquiring credentials: Minor Error: Unknown code 2
Acquiring credentials - Maj Stat: 851968 Min Stat: 2
*********Error End*************************************************************************
I've also tried the "gss_add_cred" command and get the same exact erros in both scenarios. I believe I've to acquire credentials due to the fact that I'm an Application Service which will be accepting AP-REQ from a client which has already acquired a TGT and TGS from KDC to use my service.
Any help will be greatly appreciated!!!!
Thanks.
Ish.....
More information about the Kerberos
mailing list