[31922] in Kerberos
Re: Pending "gss_init_sec_context() failed: Unspecified GSS
daemon@ATHENA.MIT.EDU (Russ Allbery)
Thu Jan 14 14:23:46 2010
From: Russ Allbery <rra@stanford.edu>
To: kerberos@mit.edu
In-Reply-To: <72a4dfce-fd3f-4dd8-afba-48b3c29275a3@z41g2000yqz.googlegroups.com>
(Sylvain RICHET's message of "Thu, 14 Jan 2010 01:58:52 -0800 (PST)")
Date: Thu, 14 Jan 2010 11:23:40 -0800
Message-ID: <87pr5cfq2r.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Sylvain RICHET <akamanouche@gmail.com> writes:
> VERY relevant question !
> It becomes clear that, with a Linux Client, something has to glue
> (just like it is in w2k environment, at the session init, in
> interaction with the domain controler)
> On linux client, this *something* is precisely : kinit !
> So, i have launched a kinit command on my Firefox (Ubuntu) client.
> And then, sniffing with WireShark shows me that the SPNEGO token is
> transmitted in headers :
> [...]
> Authorization: Negotiate YII....
> [...]
> In Firefox log (easily enabled by command : export
> NSPR_LOG_MODULES=negotiateauth:5;export NSPR_LOG_FILE=/tmp/
> negociateauth.log)
> no more error like :
> "gss_init_sec_context() failed: Unspecified GSS failure. Minor code
> may provide more information SPNEGO cannot find mechanisms to
> negotiate..."
> Everything seems to be ok.
Something to watch out for: in the past, with at least some builds of
Firefox, I've found that I needed to have a valid ticket cache *before* I
start Firefox, or at least before the first time Firefox encounters
Negotiate-Auth, or something internally caches the fact that Kerberos
authentication doesn't work and then will never try again.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
