gss_init_sec_context with delegated_cred_handle error

[Xie, Hugh]

The mailing server mess up the string of the principal into email

Here is uppercase principal "USERID @ MY.DOMAIN.COM" and the lower case principal is "userid @ my.domain.com"


From: Xie, Hugh
Sent: Thursday, October 23, 2014 11:39 AM
To: <kerberos at mit.edu>
Subject: gss_init_sec_context with delegated_cred_handle error

Hi,

When I pass GSS_C_NO_CREDENTIAL as cred_handle to gss_init_sec_context(), I got no error. But when I pass delegated_cred_handle (output from gss_accept_sec_context) as cred_handle to gss_init_sec_context(), I got 'Matching credential not found' error. It seems that when passing delegated_cred_handle gss_init_sec_context care about ticket cache. In my case the default principal in the ticket cache was upper case USERID at MY.DOMAIN.COM<mailto:USERID at MY.DOMAIN.COM>. Currently, I can remedy the situation by running a 'kinit userid at MY.DOMAIN.COM<mailto:userid at MY.DOMAIN.COM> -t -v $KRB5_KTNAME' to create a lower case default principal userid at MY.DOMAIN.COM<mailto:userid at MY.DOMAIN.COM>.

I have two questions:

1.      Why gss_init_sec_context care about ticket cache default principal when using delegated_cred_handle? Why it works when I am not delegating?

2.      Is there a better approach to remedy this problem other than kinit since the ticket cache could expire overtime, I am running a web service that could stop working if it expires? Is there a code based solution?

I am using krb5 version 1.11.5

----------------------------------------------------------------------
This message, and any attachments, is for the intended recipient(s) only, may contain information that is privileged, confidential and/or proprietary and subject to important terms and conditions available at http://www.bankofamerica.com/emaildisclaimer.   If you are not the intended recipient, please delete this message.