Re: MIT Kerberos 1.4.x and replay cache troubles
Russ Allbery <rra <at> stanford.edu>
2006-05-11 21:39:58 GMT
Michael Hocke <michael.hocke <at> nyu.edu> writes:
> I have been trying to get my MIT Kerberos 1.4.3 to work with
> mod_auth_kerb-5.0rc7 for a couple of days now and I am still running
> into replay cache problems. I adjusted the mit-internals.h and
> mod_auth_kerb.c according to some other pointers found here to no avail.
You need this patch, which I believe has already been committed to CVS
with some modifications.
diff -urNad libapache-mod-auth-kerb~/src/mod_auth_kerb.c libapache-mod-auth-kerb/src/mod_auth_kerb.c
--- libapache-mod-auth-kerb~/src/mod_auth_kerb.c 2006-03-30 17:39:29.000000000 -0800
+++ libapache-mod-auth-kerb/src/mod_auth_kerb.c 2006-03-30 17:41:56.000000000 -0800
<at> <at> -271,35 +271,6 <at> <at>
}
#endif
-#if defined(KRB5) && !defined(HEIMDAL)
-/* Needed to work around problems with replay caches */
-#include "mit-internals.h"
-
-/* This is our replacement krb5_rc_store function */
-static krb5_error_code KRB5_LIB_FUNCTION
-mod_auth_kerb_rc_store(krb5_context context, krb5_rcache rcache,
- krb5_donot_replay_internal *donot_replay)
-{
- return 0;
-}
-
-/* And this is the operations vector for our replay cache */
-const krb5_rc_ops_internal mod_auth_kerb_rc_ops = {
- 0,
- "dfl",
- krb5_rc_dfl_init,
- krb5_rc_dfl_recover,
- krb5_rc_dfl_destroy,
- krb5_rc_dfl_close,
- mod_auth_kerb_rc_store,
- krb5_rc_dfl_expunge,
- krb5_rc_dfl_get_span,
- krb5_rc_dfl_get_name,
- krb5_rc_dfl_resolve
-};
-#endif
-
-
/***************************************************************************
Auth Configuration Initialization
***************************************************************************/
<at> <at> -1139,6 +1110,12 <at> <at>
char buf[1024];
int have_server_princ;
+#ifndef HEIMDAL
+ /* Suppress the MIT replay cache. Requires MIT Kerberos 1.4.0 or later. */
+ if (getenv("KRB5RCACHETYPE") == NULL)
+ putenv("KRB5RCACHETYPE=none");
+#endif
+
have_server_princ = conf->krb_service_name && strchr(conf->krb_service_name, '/') != NULL;
if (have_server_princ)
strncpy(buf, conf->krb_service_name, sizeof(buf));
<at> <at> -1186,27 +1163,6 <at> <at>
return HTTP_INTERNAL_SERVER_ERROR;
}
-#ifndef HEIMDAL
- /*
- * With MIT Kerberos 5 1.3.x the gss_cred_id_t is the same as
- * krb5_gss_cred_id_t and krb5_gss_cred_id_rec contains a pointer to
- * the replay cache.
- * This allows us to override the replay cache function vector with
- * our own one.
- * Note that this is a dirty hack to get things working and there may
- * well be unknown side-effects.
- */
- {
- krb5_gss_cred_id_t gss_creds = (krb5_gss_cred_id_t) *server_creds;
-
- if (gss_creds && gss_creds->rcache && gss_creds->rcache->ops &&
- gss_creds->rcache->ops->type &&
- memcmp(gss_creds->rcache->ops->type, "dfl", 3) == 0)
- /* Override the rcache operations */
- gss_creds->rcache->ops = &mod_auth_kerb_rc_ops;
- }
-#endif
-
return 0;
}
--
--
Russ Allbery (rra <at> stanford.edu) <http://www.eyrie.org/~eagle/>
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
RSS Feed