[19365] in Kerberos_V5_Development
Expired Krb5 TGT prevents GSSAPI from calling SPNEGO plugins
daemon@ATHENA.MIT.EDU (Adam Bernstein)
Tue Mar 1 14:00:16 2016
To: krbdev list <krbdev@mit.edu>
From: Adam Bernstein <abernstein@vmware.com>
Message-ID: <56D5E6B2.5010108@vmware.com>
Date: Tue, 1 Mar 2016 11:00:02 -0800
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="------------050103060703070407080700"
Errors-To: krbdev-bounces@mit.edu
--------------050103060703070407080700
Content-Type: text/plain; charset="utf-8"; format=flowed
Content-Transfer-Encoding: 7bit
_*BACKGROUND*_*:*
VMware vcenter product initial configuration uses a GSSAPI plugin
implementing the Secure Remote Password (SRP) protocol. This is a
"bootstrap" authentication protocol, used to store initial
authentication identities in our LDAP directory, and other operations
requiring security. During configuration, DCE/RPC secured by GSSAPI/SRP
is used. Once configured, DCE/RPC secured by GSSAPI/KRB5 is used. We are
using MIT Kerberos version 1.14.
_*ISSUE:*_
During development, we discovered an expired Kerberos credentials cache
causes GSSAPI krb5_gss_inquire_cred() to fail with the error
GSS_S_CREDENTIALS_EXPIRED. This prevents SPNEGO from attempting
authentication with plugin mechanisms configured in /etc/gss/mech.
To reproduce this problem, the current user must have a Kerberos
credentials cache containing an expired krbtgt. For example, see the
below expired credentials cache:
# /opt/likewise/bin/klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: sles11-test2.testlab15.com@VSPHERE.LOCAL
Valid starting Expires Service principal
02/24/2016 16:28:36 02/24/2016 16:34:34 krbtgt/VSPHERE.LOCAL@VSPHERE.LOCAL
GSSAPI authentication with SRP is not possible for the user
"sles11-test2.testlab15.com@VSPHERE.LOCAL" when this expired ticket
exists. After deleting this expired cache, SPNEGO authentication
proceeds to SRP.
_*PROPOSED SOLUTION:*_
Attached is a patch for gssapi/mechglue/g_inq_cred.c : gss_inq_cred()
which fixes this issue.
The strategy used in this patch is rather than returning the error
GSS_S_CREDENTIALS_EXPIRED, skip adding the Kerberos mech OID to the
"mechs" OID set.
When krb5_gss_inquire_cred() returns GSS_S_CREDENTIALS_EXPIRED,
mech_offset is set to 1. The assumption made here is the Kerberos mech
OID always exists and is always first in the union_cred->mechs array.
When GSS_S_CREDENTIALS_EXPIRED is returned, the Kerberos OID is not
added to the mechs OID set.
Should "mechanisms" be NULL, the original behavior of returning an empty
OID set is preserved, unless krb5_gss_inquire_cred() failed with
GSS_S_CREDENTIALS_EXPIRED, then that error is returned.
Note: The patch does properly preserve tab/space indentation. Depending
on your email reader, this may not appear to be true.
Please consider accepting the following patch for inclusion in the next
release of MIT Kerberos.
Thanks,
Adam
====
Adam Bernstein
Staff Engineer, VMware
abernstein@vmware.com
500 108th Ave NE, Bellevue WA, 98004
--------------050103060703070407080700
Content-Type: text/plain; charset="UTF-8"; x-mac-type=0; x-mac-creator=0;
name="g_inq_cred.c.patch"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="g_inq_cred.c.patch"
PT09PSAvL3B1YmxpYy92bXdhcmUtbGlrZXdpc2Utb3Blbi02LTEvbGlrZXdpc2Utc3RhYmxl
L2xpa2V3aXNlLXY2LjEvbGlrZXdpc2Utb3Blbi9rcmI1L3NyYy9saWIvZ3NzYXBpL21lY2hn
bHVlL2dfaW5xX2NyZWQuYyMzIC0gL21udC9oZ2ZzL2FiZXJuc3RlaW4vd29ya3NwYWNlcy9w
YW5kYS92bXdhcmUtbGlrZXdpc2Utb3Blbi02LTEvbGlrZXdpc2Utc3RhYmxlL2xpa2V3aXNl
LXY2LjEvbGlrZXdpc2Utb3Blbi9rcmI1L3NyYy9saWIvZ3NzYXBpL21lY2hnbHVlL2dfaW5x
X2NyZWQuYyA9PT09CioqKioqKioqKioqKioqKgoqKiogNTEsNTYgKioqKgotLS0gNTEsNTgg
LS0tLQogIAogIHsKICAgICAgT01fdWludDMyCQlzdGF0dXMsIHRlbXBfbWlub3Jfc3RhdHVz
OworICAgICBPTV91aW50MzIJCXN0YXR1czIgPSAwOworICAgICBPTV91aW50MzIJCW1lY2hf
b2Zmc2V0ID0gMDsKICAgICAgZ3NzX3VuaW9uX2NyZWRfdAl1bmlvbl9jcmVkOwogICAgICBn
c3NfbWVjaGFuaXNtCW1lY2g7CiAgICAgIGdzc19jcmVkX2lkX3QJbWVjaF9jcmVkOwoqKioq
KioqKioqKioqKioKKioqIDEwMCwxMTAgKioqKgogICAgICBzdGF0dXMgPSBtZWNoLT5nc3Nf
aW5xdWlyZV9jcmVkKG1pbm9yX3N0YXR1cywgbWVjaF9jcmVkLAogIAkJCQkgICAgbmFtZSA/
ICZtZWNoX25hbWUgOiBOVUxMLAogIAkJCQkgICAgbGlmZXRpbWUsIGNyZWRfdXNhZ2UsIE5V
TEwpOwohICAgICBpZiAoc3RhdHVzICE9IEdTU19TX0NPTVBMRVRFKSB7CiAgCW1hcF9lcnJv
cihtaW5vcl9zdGF0dXMsIG1lY2gpOwogIAlyZXR1cm4oc3RhdHVzKTsKICAgICAgfQogIAog
ICAgICBpZiAobmFtZSkgewogIAkvKiBDb252ZXJ0IG1lY2hfbmFtZSBpbnRvIGEgdW5pb25f
bmFtZSBlcXVpdmFsZW50LiAqLwogIAlzdGF0dXMgPSBnc3NpbnRfY29udmVydF9uYW1lX3Rv
X3VuaW9uX25hbWUoJnRlbXBfbWlub3Jfc3RhdHVzLAotLS0gMTAyLDExNyAtLS0tCiAgICAg
IHN0YXR1cyA9IG1lY2gtPmdzc19pbnF1aXJlX2NyZWQobWlub3Jfc3RhdHVzLCBtZWNoX2Ny
ZWQsCiAgCQkJCSAgICBuYW1lID8gJm1lY2hfbmFtZSA6IE5VTEwsCiAgCQkJCSAgICBsaWZl
dGltZSwgY3JlZF91c2FnZSwgTlVMTCk7CiEgICAgIGlmIChzdGF0dXMgIT0gR1NTX1NfQ09N
UExFVEUgJiYgc3RhdHVzICE9IEdTU19TX0NSRURFTlRJQUxTX0VYUElSRUQpIHsKICAJbWFw
X2Vycm9yKG1pbm9yX3N0YXR1cywgbWVjaCk7CiAgCXJldHVybihzdGF0dXMpOwogICAgICB9
CiAgCisgICAgIHN0YXR1czIgPSBzdGF0dXM7CisgICAgIGlmIChzdGF0dXMyID09IEdTU19T
X0NSRURFTlRJQUxTX0VYUElSRUQpIHsKKyAgICAgICAgIG1lY2hfb2Zmc2V0ID0gMTsKKyAg
ICAgfQorIAogICAgICBpZiAobmFtZSkgewogIAkvKiBDb252ZXJ0IG1lY2hfbmFtZSBpbnRv
IGEgdW5pb25fbmFtZSBlcXVpdmFsZW50LiAqLwogIAlzdGF0dXMgPSBnc3NpbnRfY29udmVy
dF9uYW1lX3RvX3VuaW9uX25hbWUoJnRlbXBfbWlub3Jfc3RhdHVzLAoqKioqKioqKioqKioq
KioKKioqIDEyMiwxMzQgKioqKgogICAgICAgKi8KICAKICAgICAgaWYobWVjaGFuaXNtcyAh
PSBOVUxMKSB7CiEgCWlmICh1bmlvbl9jcmVkKSB7CiAgCSAgICBzdGF0dXMgPSBnc3NpbnRf
bWFrZV9wdWJsaWNfb2lkX3NldChtaW5vcl9zdGF0dXMsCiEgCQkJCQkJdW5pb25fY3JlZC0+
bWVjaHNfYXJyYXksCiEgCQkJCQkJdW5pb25fY3JlZC0+Y291bnQsICZtZWNocyk7CiAgCSAg
ICBpZiAoR1NTX0VSUk9SKHN0YXR1cykpCiAgCQlnb3RvIGVycm9yOwogIAl9IGVsc2Ugewog
IAkgICAgc3RhdHVzID0gZ3NzX2NyZWF0ZV9lbXB0eV9vaWRfc2V0KG1pbm9yX3N0YXR1cywg
Jm1lY2hzKTsKICAJICAgIGlmIChHU1NfRVJST1Ioc3RhdHVzKSkKICAJCWdvdG8gZXJyb3I7
Ci0tLSAxMjksMTQ1IC0tLS0KICAgICAgICovCiAgCiAgICAgIGlmKG1lY2hhbmlzbXMgIT0g
TlVMTCkgewohIAlpZiAodW5pb25fY3JlZCAmJiAodW5pb25fY3JlZC0+Y291bnQgLSBtZWNo
X29mZnNldCkgPiAwKSB7CiAgCSAgICBzdGF0dXMgPSBnc3NpbnRfbWFrZV9wdWJsaWNfb2lk
X3NldChtaW5vcl9zdGF0dXMsCiEgCQkJCQkJJnVuaW9uX2NyZWQtPm1lY2hzX2FycmF5W21l
Y2hfb2Zmc2V0XSwKISAJCQkJCQl1bmlvbl9jcmVkLT5jb3VudCAtIG1lY2hfb2Zmc2V0LCAm
bWVjaHMpOwogIAkgICAgaWYgKEdTU19FUlJPUihzdGF0dXMpKQogIAkJZ290byBlcnJvcjsK
ICAJfSBlbHNlIHsKKyAgICAgICAgICAgICBpZiAoc3RhdHVzMiA9PSBHU1NfU19DUkVERU5U
SUFMU19FWFBJUkVEKSB7CisgCQlzdGF0dXMgPSBHU1NfU19DUkVERU5USUFMU19FWFBJUkVE
OworIAkJZ290byBlcnJvcjsKKyAgICAgICAgICAgICB9CiAgCSAgICBzdGF0dXMgPSBnc3Nf
Y3JlYXRlX2VtcHR5X29pZF9zZXQobWlub3Jfc3RhdHVzLCAmbWVjaHMpOwogIAkgICAgaWYg
KEdTU19FUlJPUihzdGF0dXMpKQogIAkJZ290byBlcnJvcjsK
--------------050103060703070407080700
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
--------------050103060703070407080700--
