[35742] in Kerberos
Re: MS KRB5 vs KRB 5 GSS API/SPNEGO question
daemon@ATHENA.MIT.EDU (Prakash Narayanaswamy)
Tue Feb 4 14:16:23 2014
MIME-Version: 1.0
In-Reply-To: <CANeUsQ_5E1vTE3CcDSaw3HJtwdJ4dxY+ozxPUB2DqPbVPxcubg@mail.gmail.com>
From: Prakash Narayanaswamy <prakash@nutanix.com>
Date: Tue, 4 Feb 2014 11:15:53 -0800
Message-ID: <CANeUsQ-_ZpNkjN8Sme7JeDpp+6kREUgoPVZgNZz6irxsH6rgsA@mail.gmail.com>
To: Greg Hudson <ghudson@mit.edu>
Cc: Rohit Jain <rohit@nutanix.com>, kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Greg, the patch that you gave us fixed the issue. Thanks for the prompt
debugging and a quick patch.
Prakash
On Mon, Feb 3, 2014 at 6:53 PM, Prakash Narayanaswamy
<prakash@nutanix.com>wrote:
> Thanks a lot, Greg. We'll take the patch, apply it, test it and get back
> to you. Thanks again.
>
> Prakash
>
> Prakash N | 408 771 4273
>
>
>
> On Mon, Feb 3, 2014 at 6:31 PM, Greg Hudson <ghudson@mit.edu> wrote:
>
>> On 02/03/2014 02:26 PM, Prakash Narayanaswamy wrote:
>> > Hello, We are trying to get a service (a SMB server) running on Linux
>> > kerberized using the GSS API. During the negotiation (SPNEGO), the
>> Windows
>> > SMB client specifies MS KRB5 (1.2.840.48018.1.2.2) as the preferred
>> > mechanism and supplies the initial token. The gss_accept_sec_context
>> method
>> > on the server accepts the token and generates a *NegTokenResp*, setting
>> the
>> > *negState* to *"accept-completed"* and *supportedMech* to *KRB5
>> > (1.2.840.113554.1.2.2)* among other things.
>> [...]
>> > The question now is this: Is there a better way of doing this? Are we
>> > missing something here?
>>
>> Nope, it's just a bug. I apparently introduced it in 1.10 when fixing
>> another issue. Thanks for investing it in enough detail to make it easy
>> to find the mistake.
>>
>> Here is a candidate fix, which should make its way into master and 1.12.2:
>>
>> https://github.com/greghudson/krb5/commits/spnegofix
>>
>> Here is the bug-tracker entry I filed:
>>
>> http://krbdev.mit.edu/rt/Ticket/Display.html?id=7858
>>
>
>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
