[modauthkerb] Negotiate on Windows with cross-realm trust ADand MIT Kereros.
Douglas E. Engert
deengert at anl.gov
Fri Jul 27 12:11:09 EDT 2007
I stil think you have a client problem, of the client not delegating.
Can you use IE, or FireFox on some other platform to connecto your
server?
Mikkel Kruse Johnsen wrote:
> Hi
>
> Settings check:
>
> network.negotiate-auth.allow-proxies = true
> network.negotiate-auth.delegation-uris = cbs.dk,hhk.dk
> network.negotiate-auth.gsslib =
> network.negotiate-auth.trusted-uris = cbs.dk,hhk.dk
> network.negotiate-auth.using-native-gsslib = true
>
> After the patch (attached) I get this. So it seems that status is
> GSS_S_COMPLETE:
>
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1457): [client
> 130.226.36.170] kerb_authenticate_user entered with user (NULL) and
> auth_type Kerberos
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1457): [client
> 130.226.36.170] kerb_authenticate_user entered with user (NULL) and
> auth_type Kerberos
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1148): [client
> 130.226.36.170] Acquiring creds for HTTP/sugi.cbs.dk at CBS.DK
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1269): [client
> 130.226.36.170] Verifying client data using KRB5 GSS-API
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1285): [client
> 130.226.36.170] Verification returned code 0
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1303): [client
> 130.226.36.170] GSS-API token of length 22 bytes will be sent back
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1351): [client
> 130.226.36.170] set cached name mkj.lib at CBS.DK for connection
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1360): [client
> 130.226.36.170] krb_save_credentials activated, GSS_C_DELEG_FLAG
> available
> [Fri Jul 27 09:09:50 2007] [error] [client 130.226.36.170] Cannot store
> delegated credential (gss_krb5_copy_ccache: Invalid credential was
> supplied (No error))
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1457): [client
> 130.226.36.170] kerb_authenticate_user entered with user (NULL) and
> auth_type Kerberos, referer: http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1457): [client
> 130.226.36.170] kerb_authenticate_user entered with user (NULL) and
> auth_type Kerberos, referer: http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1457): [client
> 130.226.36.170] kerb_authenticate_user entered with user (NULL) and
> auth_type Kerberos, referer: http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1148): [client
> 130.226.36.170] Acquiring creds for HTTP/sugi.cbs.dk at CBS.DK, referer:
> http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1269): [client
> 130.226.36.170] Verifying client data using KRB5 GSS-API, referer:
> http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1285): [client
> 130.226.36.170] Verification returned code 0, referer:
> http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1303): [client
> 130.226.36.170] GSS-API token of length 22 bytes will be sent back,
> referer: http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1351): [client
> 130.226.36.170] set cached name mkj.lib at CBS.DK for connection, referer:
> http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1360): [client
> 130.226.36.170] krb_save_credentials activated, GSS_C_DELEG_FLAG
> available, referer: http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [error] [client 130.226.36.170] Cannot store
> delegated credential (gss_krb5_copy_ccache: Invalid credential was
> supplied (No error)), referer: http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1457): [client
> 130.226.36.170] kerb_authenticate_user entered with user (NULL) and
> auth_type Kerberos, referer: http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1148): [client
> 130.226.36.170] Acquiring creds for HTTP/sugi.cbs.dk at CBS.DK, referer:
> http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1269): [client
> 130.226.36.170] Verifying client data using KRB5 GSS-API, referer:
> http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1285): [client
> 130.226.36.170] Verification returned code 0, referer:
> http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1303): [client
> 130.226.36.170] GSS-API token of length 22 bytes will be sent back,
> referer: http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1351): [client
> 130.226.36.170] set cached name mkj.lib at CBS.DK for connection, referer:
> http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [debug] src/mod_auth_kerb.c(1360): [client
> 130.226.36.170] krb_save_credentials activated, GSS_C_DELEG_FLAG
> available, referer: http://od.cbs.dk/phpinfo.php
> [Fri Jul 27 09:09:50 2007] [error] [client 130.226.36.170] Cannot store
> delegated credential (gss_krb5_copy_ccache: Invalid credential was
> supplied (No error)), referer: http://od.cbs.dk/phpinfo.php
>
> /Mikkel
>
>
> On Thu, 2007-07-26 at 22:38 +0200, Achim Grolms wrote:
>
>> On Thursday 26 July 2007 21:54, Douglas E. Engert wrote:
>>> Achim Grolms wrote:
>>>> On Thursday 26 July 2007 20:40, Henry B. Hotz wrote:
>>>>>> If I understand RFC2744 correct GSS_C_DELEG_FLAG
>>>>>> would not be set in that case?
>>>>>>
>>>>>> Achim
>>>>> Agreed. That flag shouldn't be set AFAIK, though the value isn't
>>>>> valid until negotiation is complete.
>>>> That means before trying to store delegated credentials
>>>> and before checking GSS_C_DELEG_FLAG
>>>> mod_auth_kerb needs to check if gss_accept_sec_context ()
>>>> returns major_status = GSS_S_COMPLETE
>> From my point of view this means that mod_auth_kerb
>> needs a change in code.
>> I needs to be of that style:
>>
>> the major_status of
>> gss_accept_sec_context()
>>
>> needs to be checked before checking GSS_C_DELEG_FLAG.
>>
>> This can be done this way:
>>
>> if ( major_status_accept = GSS_S_COMPLETE ) {
>> if (conf->krb_save_credentials) {
>> if (delegated_cred != GSS_C_NO_CREDENTIAL) {
>> .
>> .
>> .
>> }
>> }
>> }
>>
>>
>> major_status_accept is the major_status returned by
>> accept_sec_token
>>
>> Mikkel, can you give this a try?
>> Achim
>> Received-SPF: pass (0: SPF record at ispgateway.de designates 80.67.18.15 as permitted sender)
>>
>> !DSPAM:46a9068820551136180008!
>>
>
> Mikkel Kruse Johnsen
> Linet
> Ørholmgade 6 st tv
> 2200 København N
>
> Tlf: +45 2128 7793
> email: mikkel at linet.dk
> www: http://www.linet.dk
>
>
> ------------------------------------------------------------------------
>
> diff -r -u mod_auth_kerb-5.3.orig/src/mod_auth_kerb.c mod_auth_kerb-5.3/src/mod_auth_kerb.c
> --- mod_auth_kerb-5.3.orig/src/mod_auth_kerb.c 2007-07-25 11:38:20.000000000 +0200
> +++ mod_auth_kerb-5.3/src/mod_auth_kerb.c 2007-07-27 09:09:21.000000000 +0200
> @@ -1215,6 +1215,8 @@
> spnego_oid.length = 6;
> spnego_oid.elements = (void *)"\x2b\x06\x01\x05\x05\x02";
>
> + OM_uint32 acc_ret_flags;
> +
> if (conf->krb_5_keytab) {
> char *ktname;
> /* we don't use the ap_* calls here, since the string passed to putenv()
> @@ -1277,7 +1279,7 @@
> &client_name,
> NULL,
> &output_token,
> - NULL,
> + &acc_ret_flags,
> NULL,
> &delegated_cred);
> log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
> @@ -1351,8 +1353,30 @@
> }
> #endif
>
> - if (conf->krb_save_credentials && delegated_cred != GSS_C_NO_CREDENTIAL)
> - store_gss_creds(r, conf, (char *)output_token.value, delegated_cred);
> + if (major_status == GSS_S_COMPLETE ) {
> + if (conf->krb_save_credentials) {
> + if (delegated_cred != GSS_C_NO_CREDENTIAL) {
> + if ( acc_ret_flags & GSS_C_DELEG_FLAG ) {
> + log_rerror( APLOG_MARK, APLOG_DEBUG, 0, r,
> + "krb_save_credentials activated, GSS_C_DELEG_FLAG available", "" );
> +
> + store_gss_creds(r, conf, (char *)output_token.value, delegated_cred);
> + }
> + else {
> + log_rerror( APLOG_MARK, APLOG_ERR, 0, r,
> + "krb_save_credentials activated, no GSS_C_DELEG_FLAG", "" );
> + }
> + }
> + else {
> + log_rerror( APLOG_MARK, APLOG_ERR, 0, r,
> + "krb_save_credentials activated, no GSS_C_NO_CREDENTIAL", "" );
> + }
> + }
> + }
> + else {
> + log_rerror( APLOG_MARK, APLOG_ERR, 0, r,
> + "krb_save_credentials not activated, no GSS_S_COMPLETE", "" );
> + }
>
> gss_release_buffer(&minor_status, &output_token);
>
>
>
> ------------------------------------------------------------------------
>
> ________________________________________________
> Kerberos mailing list Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
--
Douglas E. Engert <DEEngert at anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444
More information about the Kerberos
mailing list