unsupported mechanism?
Yalenti, Mark <myalenti <at> tollgrade.com>
2007-01-09 19:43:23 GMT
All,
I've working on getting mod_auth_kerb to work on my Solaris 10 system.
I have been able to get it compiled and installed finally but now i have
one last problem that i need to address. But first... The delicate
history here which i'm sure everyone will need to know..
Solaris 10 as you know includes its own version of
Kerberos....(ugh!)This is of course installed by default on my system. I
quickly realized that this coveted module would not work with solaris
Kerberos so i got the MIT K5 installed on my system.
The apache installation that i am using is not the one that was bundles
with Solaris but rather one that i have downloaded and manually compiled
to suit my needs.(Apache 2.0) It launches without a problem and serves
up web pages i have also made sure to enable DSO support... As far as i
am concerned, apache is running like a champ. I have also verified that
my MIT kerberos installation is working properly by way of the
following...
# ./kinit -5 -V -k -t /usr/home/myalenti/apache.keytab
HTTP/apache.toll-kerberos.com
Authenticated to Kerberos v5
(So i know that kerberos is working....)
Ok the sticky stuff...
1- I removed the Solaris implementation of Kerberos. So only MIT kerb is
on the system and still functions fine.
2- My configure command looked like the following....
./configure --without-krb4 --with-krb5=/usr/kerberos5/
--with-apache=/opt/apache2/
No errors were reported in this phase of the build process.
3- time for "make" ...This is where things got really messy.
the resulting make file, it turns out, is bad... the linking and
compiler options that are cited at the begining of the file end up
getting wipped out by the time they are applied to the apxs command.
Needless to say the make is riddled with errors, of which at the very
begining mentions that it cannot find header files that i know are
included. There is evidently something wrong with with the following
lines....
APXS_CPPFLAGS = ${shell [ -n "${CPPFLAGS}" ] && echo ${CPPFLAGS} | sed
-e 's/\([^ ]*\)/-Wc,\1/g'}
APXS_LDFLAGS = ${shell [ -n "${LDFLAGS}" ] && echo ${LDFLAGS} | sed -e
's/\([^ ]*\)/-Wl,\1/g'}
So i fixed (or some variation of fixed) the problem by manually
re-writing the lines to say....
APXS_CPPFLAGS = $(CPPFLAGS)
APXS_LDFLAGS= $(LDFLAGS)
thereby skipping the sed statements and the check for a null
value...I could not determine why my vars got cleared but i was able to
verify that this step is what did it.
so at this point my vars look like this.
echo "APXS_CPPFLAGS= -I. -Ispnegokrb5 -I/usr/kerberos5/include "
echo "APXS_LDFLAGS= -L/usr/kerberos5/lib -R/usr/kerberos/lib
-lgssapi_krb5 -lkrb5 -lk5crypto -lcom_err -lresolv -lsocket -lnsl
-lresolv"
But there is still another problem apxs chokes on "-R/usr/kerberos/lib"
it does not like the -R option! So i kinda just removed it...(I still
don't know what effect this will have, nor an i identify what the
purpose of -R is for apxs!)
Having made these changes, i can get the module to compile and install.
Once installed, I follow all the directions that are listed on the
support site to configure a directory and a .htaccess file that looks
like the following.
# cat /opt/apache2/htdocs/krb5/.htaccess
AuthType Kerberos
KrbAuthRealms TOLL-KERBEROS.com
KrbServiceName HTTP
Krb5Keytab /usr/home/myalenti/apache.keytab
Require valid-user
With the appropriate lines in the httpd.conf file which are....
LoadModule auth_kerb_module modules/mod_auth_kerb.so
and
<Directory "/opt/apache2/htdocs/krb5">
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
Allow from all
</Directory>
So far everyone is happy. I can launch apache and it comes up like a
good little program... So i try to access the protected web site....And
to my great joy i am presented with a Login Pop-up from my browser... I
type in the appropriate credentials, (credentials that i have tested
with kinit btw) and wait...and wait....and wait... to finally get and
"internal error message."
Ok fine...What's the deal... I look into apache's error_log file to find
the following...
[Tue Jan 09 13:26:39 2007] [error] [client 10.2.242.6]
gss_acquire_cred() failed: An unsupported mechanism was req
uested
So close and yet so far! I can't be too far away now! Can someone shed
some desparately needed light?
Please keep in mind that i am not a programmer, although i do understand
programming.
I was wondering if the sed statements that i stripped out of my makefile
would have led to this problem. Also, i'm not entirely sure what the
error message is trying to tell me. "unsupported mechanism" Its a run
time issue, no load time, so i can only assume that my module has been
built correctly....
And just in case you would like to have the config.log... its
attached....
Thanks in advance for your help! <<config.log>>
BTW
Mark Yalenti
Systems Support and Deployment
Tollgrade Communications
685 US RT 202/206 South
Bridgewater, NJ 08807
-------------------------------------
Toll-Free: 1-800-777-5405
Office: (908) 243 - 3940
Cell: (908) 246 - 2922
AIM: myalenti
Skype: myalenti
“Notice: This electronic mail message is intended exclusively for the
individual or entity to which it is addressed. This message, together
with any attachments, may contain confidential and privileged information.
Any unauthorized review, use, printing , retention, copying ,
disclosure or distribution is strictly prohibited. If you have received this
message in error, please immediately advise the sender by reply email message
to the sender and delete all copies of this message.”
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
modauthkerb-help mailing list
modauthkerb-help <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/modauthkerb-help
RSS Feed