From krb5-bugs-incoming-bounces@PCH.MIT.EDU Thu Oct 4 18:17:06 2007 Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by krbdev.mit.edu (8.12.9) with ESMTP id l94MH6HW011948; Thu, 4 Oct 2007 18:17:06 -0400 (EDT) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id l94MH09V008144; Thu, 4 Oct 2007 18:17:00 -0400 Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.7.7.76]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id l94M5rb9004995 for ; Thu, 4 Oct 2007 18:05:54 -0400 Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223]) by fort-point-station.mit.edu (8.13.6/8.9.2) with ESMTP id l94M5jxP022431 for ; Thu, 4 Oct 2007 18:05:46 -0400 (EDT) Received: from mx1.redhat.com (mx1.redhat.com [66.187.233.31]) by mit.edu (Spam Firewall) with ESMTP id AAEBA84B132 for ; Thu, 4 Oct 2007 18:05:44 -0400 (EDT) Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com [172.16.52.254]) by mx1.redhat.com (8.13.8/8.13.1) with ESMTP id l94M5iZZ024227 for ; Thu, 4 Oct 2007 18:05:44 -0400 Received: from blade.boston.redhat.com (blade.boston.redhat.com [172.16.80.50]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l94M5hvv022915 for ; Thu, 4 Oct 2007 18:05:43 -0400 Received: from blade.boston.redhat.com (localhost.localdomain [127.0.0.1]) by blade.boston.redhat.com (8.14.1/8.14.1) with ESMTP id l94M5hbI027504 for ; Thu, 4 Oct 2007 18:05:43 -0400 Received: (from nalin@localhost) by blade.boston.redhat.com (8.14.1/8.14.1/Submit) id l94M5has027503; Thu, 4 Oct 2007 18:05:43 -0400 Date: Thu, 4 Oct 2007 18:05:43 -0400 Message-Id: <200710042205.l94M5has027503@blade.boston.redhat.com> To: krb5-bugs@mit.edu Subject: can't find delegated krb5 creds when using spnego From: Nalin Dahyabhai X-send-pr-version: 3.99 X-Spam-Score: 3.001 X-Spam-Level: *** (3.001) X-Spam-Flag: NO X-Scanned-By: MIMEDefang 2.42 X-Mailman-Approved-At: Thu, 04 Oct 2007 18:16:59 -0400 X-BeenThere: krb5-bugs-incoming@mailman.mit.edu X-Mailman-Version: 2.1.6 Precedence: list Reply-To: Nalin Dahyabhai Sender: krb5-bugs-incoming-bounces@PCH.MIT.EDU Errors-To: krb5-bugs-incoming-bounces@PCH.MIT.EDU >Submitter-Id: net >Originator: >Organization: >Confidential: no >Synopsis: can't store delegated krb5 creds when using spnego >Severity: non-critical >Priority: medium >Category: krb5-libs >Class: sw-bug >Release: 1.6.2 >Environment: System: Linux blade.boston.redhat.com 2.6.23-0.211.rc8.git2.fc8 #1 SMP Thu Sep 27 18:21:00 EDT 2007 x86_64 x86_64 x86_64 GNU/Linux Architecture: x86_64 >Description: When using SPNEGO, a client can delegate Kerberos credentials, but gss_krb5_copy_cache() can't find them because the delegated credential handle contains the SPNEGO mechanism OID. In this case, the credential value is itself a union credential wrapping the delegated Kerberos credentials. >How-To-Repeat: Use Firefox's negotiate auth client with libgssapi_krb5 to authenticate to Apache httpd with mod_auth_kerb. The server log on my test system shows: [Thu Oct 04 14:54:15 2007] [error] [client 172.16.80.50] Cannot store delegated credential (gss_krb5_copy_ccache: Invalid credential was supplied (No error)), referer: https://axe.boston.redhat.com/private/ >Fix: This could be worked around by just passing up the delegated credential handle in gss_accept_sec_context() when the mechanism is SPNEGO, but teaching gss_krb5_copy_ccache() to walk the credentials tree looked like a slightly simpler way to go. Index: src/lib/gssapi/mechglue/g_glue.c =================================================================== --- src/lib/gssapi/mechglue/g_glue.c (revision 20093) +++ src/lib/gssapi/mechglue/g_glue.c (working copy) @@ -33,6 +33,8 @@ #define MSO_BIT (8*(sizeof (int) - 1)) /* Most significant octet bit */ extern gss_mechanism *gssint_mechs_array; +#define SPNEGO_OID_LENGTH 6 +#define SPNEGO_OID "\053\006\001\005\005\002" /* * This file contains the support routines for the glue layer. @@ -548,6 +550,8 @@ gss_OID mech_type; { int i; + gss_union_cred_t spnego_cred; + gss_cred_id_t mech_cred; if (union_cred == GSS_C_NO_CREDENTIAL) return GSS_C_NO_CREDENTIAL; @@ -555,6 +559,17 @@ for (i=0; i < union_cred->count; i++) { if (g_OID_equal(mech_type, &union_cred->mechs_array[i])) return union_cred->cred_array[i]; + + /* if this is an spnego credential, search its contents */ + if ((union_cred->mechs_array[i].length == SPNEGO_OID_LENGTH) && + (memcmp(union_cred->mechs_array[i].elements, + SPNEGO_OID, + SPNEGO_OID_LENGTH) == 0)) { + spnego_cred = union_cred->cred_array[i]; + mech_cred = gssint_get_mechanism_cred(spnego_cred, mech_type); + if (mech_cred != GSS_C_NO_CREDENTIAL) + return mech_cred; + } } return GSS_C_NO_CREDENTIAL; }