[19233] in Kerberos_V5_Development
Re: gss_acquire_cred_with_password() and mech selection
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon Jul 13 13:12:52 2015
Message-ID: <55A3F18B.3020608@mit.edu>
Date: Mon, 13 Jul 2015 13:12:43 -0400
From: Greg Hudson <ghudson@mit.edu>
MIME-Version: 1.0
To: krbdev@mit.edu
In-Reply-To: <x7dy4iodj2w.fsf@equal-rites.mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 07/10/2015 01:21 PM, Greg Hudson wrote:
> * When called with a desired_mechs of GSS_C_NO_OID_SET, we perform six
> AS-REQs, three inside SPNEGO and three outside.
Oops, this is incorrect. Our gss_acquire_cred_with_password() already
defaults to using just the default mech in this case. So the majority
of my previous message is moot.
> * When called with a desired_mechs of SPNEGO, we perform three AS-REQs,
> one for each non-IAKERB krb5 variant.
I would still like to solve this problem, and am trying to decide on the
scope of the changes I want to make right now. Two options include:
* Omit GSS_C_MA_DEPRECATED mechs from gss_indicate_mechs(). This would
have the following secondary effects for the old and mskrb5 OIDs unless
we take additional steps:
- gss_acquire_cred would not use them when no desired_mechs is given.
- SPNEGO would not acquire creds for them and would not offer them,
even if specified by gss_set_neg_mechs(). They would still be accepted
as synonyms for krb5 by SPNEGO acceptors and mirrored properly in responses.
- gss_indicate_mechs_by_attrs() would never return them, regardless of
what attributes are queried.
- gss_inquire_mechs_for_name() would never return them.
- gss_inquire_mech_for_saslname() would never return them.
- OpenSSH would not try to negotiate them.
Although not offering the mskrb5 OID in SPNEGO seems like it might be
a problem, [MS-SPNG] suggests that it is not. Only Windows 2000 doesn't
understand the standard krb5 OID, and that release is both ancient and
client-only.
* Omit GSS_C_MA_DEPRECATED from the default gss_acquire_cred() set and
the set of mechs used by SPNEGO, probably using
gss_indicate_mechs_by_attrs(). This is a more conservative change; it
would not affect OpenSSH or hide the mechs from the other utility functions.
Either of these options create a problem for one of the test cases in
t_spnego.c which I would have to solve somehow. One option is to make
it possible to use non-SPNEGO credentials with a SPNEGO
gss_init_sec_context().
Either of the above options could also be extended to IAKERB by giving
IAKERB the GSS_C_MA_NOT_DFLT_MECH default attribute and excluding mechs
with that attribute from the same operations.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
