Ticket History #8021: SPNEGO clients should not try IAKERB by default

We implemented IAKERB in 1.9. SPNEGO automatically tries all mechanisms
except for SPNEGO itself, so it tries IAKERB after regular krb5. In
practice, this is rarely useful and often serves to complicate scenarios
which would otherwise be simple. For instance, if the user has credentials
but we cannot get a service ticket for the target host, we try IAKERB
instead of failing locally; most of the time this is unnecessary work and
obscures the resulting error message.

Limit use of IAKERB

Add the GSS_C_MA_NOT_DFLT_MECH attribute to IAKERB, and filter out
mechs with that attribute from the SPNEGO and gss_acquire_cred()
default mechanisms.

Add a -iakerb option to gss-server and pass it when performing IAKERB
tests. Also add tests using the wrong password, to verify that
gss_acquire_cred_with_password() fails with the wrong password when
using SPNEGO.

https://github.com/krb5/krb5/commit/608a65570aa868d6e03423b5de3b8f82c0bff60b
Author: Greg Hudson <ghudson@mit.edu>
Commit: 608a65570aa868d6e03423b5de3b8f82c0bff60b
Branch: master
src/appl/gss-sample/gss-server.c | 22 ++++++++--
src/appl/gss-sample/t_gss_sample.py | 60 ++++++++++++++++++++----------
src/lib/gssapi/krb5/gssapi_krb5.c | 1 +
src/lib/gssapi/mechglue/g_acquire_cred.c | 5 +-
src/lib/gssapi/spnego/spnego_mech.c | 5 +-
5 files changed, 64 insertions(+), 29 deletions(-)