Date: Fri, 08 Sep 2006 09:08:54 -0700
From: Quanah Gibson-Mount <quanah@stanford.edu>
To: rt-comment@krbdev.mit.edu
Subject: Re: [krbdev.mit.edu #4222] GSSAPI context being destroyed when ticket cache renewed
Message-Id: <5BB77338FD48BF80BA03487F@SW-90-717-287-3.stanford.edu>
In-Reply-To: <rt-4222-18558.15.9301620440506@krbdev.mit.edu>
References: <rt-4222-18558.15.9301620440506@krbdev.mit.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
RT-Send-Cc: 
Content-Length: 1474


--On Friday, September 08, 2006 5:33 AM -0400 Simon Wilkinson via RT 
<rt-comment@krbdev.mit.edu> wrote:

> As the person quoted right at the beginning, I should probably
> contribute my findings here.
>
> I don't believe that ticket refresh is an issue. I can quite happily
> refresh, destroy, or replace my Kerberos credentials from under a
> running GSSAPI context, without causing that context to break.
>
> The issue (if there is an issue) is that Heimdal and MIT's behaviour
> differ when the initiator's credentials do actually expire. Heimdal
> allows the context to continue to be used for wrapping operations
> past expiry - MIT expires the context, and calls to wrap() or unwrap
> () fail. This difference in behaviour is an issue when using SASL
> applications with security layers, as the only way to renew the
> context is to reconnect to the server. In addition, many applications
> have inadequate error handling around their security layer
> implementations.
>
> I suspect that the current MIT behaviour is correct. Whilst there's
> no explicit language in RFC2743, it suggests that the length of time
> for which the context will be valid depends on credential lifetime.


Thanks Simon for the follow-up.  So it sounds like then, the error here 
really is inside cyrus-sasl then?

--Quanah

--
Quanah Gibson-Mount
Principal Software Developer
ITS/Shared Application Services
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html