[krbdev.mit.edu #6594] gss_krb5_copy_ccache() doesn't work with spnego delegation

The RT System itself via RT rt-comment at krbdev.mit.edu
Thu Dec 10 23:20:53 EST 2009


>From krb5-bugs-incoming-bounces at PCH.mit.edu  Fri Dec 11 04:20:52 2009
Return-Path: <krb5-bugs-incoming-bounces at PCH.mit.edu>
Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90])
	by krbdev.mit.edu (Postfix) with ESMTP id 0C43ECCA06;
	Fri, 11 Dec 2009 04:20:52 +0000 (UTC)
Received: from pch.mit.edu (pch.mit.edu [127.0.0.1])
	by pch.mit.edu (8.13.6/8.12.8) with ESMTP id nBB4KpSA020970;
	Thu, 10 Dec 2009 23:20:51 -0500
Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU
	[18.7.21.83])
	by pch.mit.edu (8.13.6/8.12.8) with ESMTP id nBAKqKYn024748
	for <krb5-bugs-incoming at PCH.mit.edu>; Thu, 10 Dec 2009 15:52:20 -0500
Received: from dmz-mailsec-scanner-7.mit.edu (DMZ-MAILSEC-SCANNER-7.MIT.EDU
	[18.7.68.36])
	by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id
	nBAKiZRX004448
	for <krb5-bugs at mit.edu>; Thu, 10 Dec 2009 15:52:33 -0500 (EST)
X-AuditID: 12074424-b7cfcae0000068a6-4f-4b215f636431
Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28])
	by  (Symantec Brightmail Gateway) with SMTP id DA.E1.26790.36F512B4;
	Thu, 10 Dec 2009 15:51:47 -0500 (EST)
Received: from int-mx03.intmail.prod.int.phx2.redhat.com
	(int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.16])
	by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id nBAKpkhH028603
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
	for <krb5-bugs at mit.edu>; Thu, 10 Dec 2009 15:51:46 -0500
Received: from blade.bos.redhat.com (blade.bos.redhat.com [10.16.0.23])
	by int-mx03.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP
	id nBAKpjSp021132
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <krb5-bugs at mit.edu>; Thu, 10 Dec 2009 15:51:46 -0500
Received: from blade.bos.redhat.com (localhost [127.0.0.1])
	by blade.bos.redhat.com (8.14.3/8.14.3) with ESMTP id nBAKqBNj010077
	for <krb5-bugs at mit.edu>; Thu, 10 Dec 2009 15:52:11 -0500
Received: (from nalin at localhost)
	by blade.bos.redhat.com (8.14.3/8.14.3/Submit) id nBAKqBOt010076;
	Thu, 10 Dec 2009 15:52:11 -0500
Date: Thu, 10 Dec 2009 15:52:11 -0500
Message-Id: <200912102052.nBAKqBOt010076 at blade.bos.redhat.com>
To: krb5-bugs at mit.edu
Subject: gss_krb5_copy_ccache() doesn't work with spnego delegation
From: nalin at redhat.com
X-send-pr-version: 3.99
X-Scanned-By: MIMEDefang 2.42
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.16
X-Brightmail-Tracker: AAAAAxIFCWQSBQvfEgUL4A==
X-Spam-Score: 0.55
X-Spam-Flag: NO
X-Mailman-Approved-At: Thu, 10 Dec 2009 23:20:45 -0500
X-BeenThere: krb5-bugs-incoming at mailman.mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
Reply-To: nalin at redhat.com
Sender: krb5-bugs-incoming-bounces at PCH.mit.edu
Errors-To: krb5-bugs-incoming-bounces at PCH.mit.edu


>Submitter-Id:	net
>Originator:	
>Organization:	Red Hat
>Confidential:	no
>Synopsis:	gss_krb5_copy_ccache() doesn't work with spnego delegation
>Severity:	non-critical
>Priority:	medium
>Category:	krb5-libs
>Class:		sw-bug
>Release:	1.7
>Environment:
	
System: Linux blade.bos.redhat.com 2.6.31.6-162.fc12.x86_64 #1 SMP Fri Dec 4 00:06:26 EST 2009 x86_64 x86_64 x86_64 GNU/Linux
Architecture: x86_64

>Description:
	We're seeing problems in mod_auth_kerb with firefox as its client, when
	firefox is configured to delegate credentials and mod_auth_kerb is
	configured to save them to disk.  In these cases, mod_auth_kerb is
	logging this error:

	  Cannot store delegated credential (gss_krb5_copy_ccache: An unsupported mechanism was requested (, Unknown error))

	Firefox is careful to use spnego when it's attempting negotiate auth,
	and other clients which aren't as careful (and which end up sending
	Kerberos tokens) work as expected.

	It looks like gss_krb5_copy_ccache() calls gssspi_set_cred_option()
	with the spnego credential handle, and gssspi_set_cred_option() returns
	GSS_S_BAD_MECH because the spnego mech doesn't provide a function
	for it to use.

>How-To-Repeat:
	Configure a client which uses spnego (such as firefox) to delegate
	credentials to a server which attempts to store delegated creds to
	a Kerberos ccache, and attempt to authenticate to the service.

>Fix:
	This is one possible patch.  It punts a set_cred_option() call down to
	the mechanism for the first credential that we have whose mechanism
	implements a set_cred_option() method.  I'm not sure this is the
	correct fix.  If this is the right fix, we may also need to change
	gssspi_set_cred_option() to keep going if it gets GSS_S_UNAVAILABLE
	back from the mechanism-specific function, but then in cases where
	there are multiple credentials, the mechanism of the first one might
	not be the right one to use anyway.

Index: src/lib/gssapi/spnego/gssapiP_spnego.h
===================================================================
--- src/lib/gssapi/spnego/gssapiP_spnego.h	(revision 23461)
+++ src/lib/gssapi/spnego/gssapiP_spnego.h	(working copy)
@@ -352,6 +352,15 @@
 );
 
 OM_uint32
+spnego_gss_set_cred_option
+(
+	OM_uint32 *minor_status,
+	gss_cred_id_t cred_handle,
+	const gss_OID desired_object,
+	const gss_buffer_t value
+);
+
+OM_uint32
 spnego_gss_set_sec_context_option
 (
	OM_uint32 *minor_status,
Index: src/lib/gssapi/spnego/spnego_mech.c
===================================================================
--- src/lib/gssapi/spnego/spnego_mech.c	(revision 23461)
+++ src/lib/gssapi/spnego/spnego_mech.c	(working copy)
@@ -250,7 +250,7 @@
	spnego_gss_inquire_sec_context_by_oid, /* gss_inquire_sec_context_by_oid */
	spnego_gss_inquire_cred_by_oid,	/* gss_inquire_cred_by_oid */
	spnego_gss_set_sec_context_option, /* gss_set_sec_context_option */
- 	NULL,				/* gssspi_set_cred_option */
+ 	spnego_gss_set_cred_option,	/* gssspi_set_cred_option */
	NULL,				/* gssspi_mech_invoke */
	spnego_gss_wrap_aead,
	spnego_gss_unwrap_aead,
@@ -2186,6 +2186,21 @@
 }
 
 OM_uint32
+spnego_gss_set_cred_option(
+		OM_uint32 *minor_status,
+		gss_cred_id_t cred_handle,
+		const gss_OID desired_object,
+		const gss_buffer_t value)
+{
+	OM_uint32 ret;
+	ret = gssspi_set_cred_option(minor_status,
+				     cred_handle,
+				     desired_object,
+				     value);
+	return (ret);
+}
+
+OM_uint32
 spnego_gss_set_sec_context_option(
		OM_uint32 *minor_status,
		gss_ctx_id_t *context_handle,




More information about the krb5-bugs mailing list