ApacheDS issues TGT kerberos ticket with address on IBM java

[Martin Choma <ma...@gmail.com>]

Hi,

ApacheDS issues TGT kerberos ticket with address on IBM java , even if
noaddresses = true is explicitelly set in krb5.conf.

Address in ticket causing problem, because ApacheDS check address in ticket
with address of connection. And that leads to error "error 38 Incorrect net
address"

I dont see this issue on IBM java and Active Directory, for instance, so I
think it is not problem of client code.

Also note that running ApacheDS with openJDK and oracle java I also don't
see this.

Only problematic combination is is ApacheDS vs. IBM java 8

Tested use case is identity propagation / delegation.

Any ideas?

Re: ApacheDS issues TGT kerberos ticket with address on IBM java

[Emmanuel Lécharny <el...@gmail.com>]

Le 28/06/16 � 07:45, Martin Choma a �crit :
> Hi,
>
> ApacheDS issues TGT kerberos ticket with address on IBM java , even if
> noaddresses = true is explicitelly set in krb5.conf.

This is not an Kerberos flag, it's an indication for the kerberos client
to not send an address to the server, AFAICT. Now, under such
circonstance, we do process the request, and send back teh ticket with
no client address.

The thing is that we would need to see what's going on on teh server,
using the logs, to see why the ticket that is sent back is incorrect.

Could you set the server's log to DEBUG, create a JIRA issue, and attach
teh logs you get ?

Kai, can you check on Kerby if this is something you support correctly ?

Re: ApacheDS issues TGT kerberos ticket with address on IBM java

[Emmanuel Lécharny <el...@gmail.com>]

Le 28/06/16 � 15:44, Martin Choma a �crit :
> I have created https://issues.apache.org/jira/browse/DIRSERVER-2156 as you
> suggest. There really is address send in TGS-REQ for krbtgt. 
Can you send the bytes that are sent to the server ? I'd liek to have
alook at the content of the message. (you can attach them to the ticket)

> Is there way
> we can workaround this behaviour? Is it bug in ibm java ignoring
> noaddresses = true flag? 
It's a possibility.

> Is it possible to configure ApacheDS not to issue
> ticket with address or skip network address check?
I don't know. Atm, we send back what we got. I really want to know if a
special flag is transmitted, and if so,yes, we can fix the code to not
send back a address.

Re: ApacheDS issues TGT kerberos ticket with address on IBM java

[Martin Choma <ma...@gmail.com>]

I have created https://issues.apache.org/jira/browse/DIRSERVER-2156 as you
suggest. There really is address send in TGS-REQ for krbtgt. Is there way
we can workaround this behaviour? Is it bug in ibm java ignoring
noaddresses = true flag? Is it possible to configure ApacheDS not to issue
ticket with address or skip network address check?


On 28 June 2016 at 07:45, Martin Choma <ma...@gmail.com> wrote:

> Hi,
>
> ApacheDS issues TGT kerberos ticket with address on IBM java , even if
> noaddresses = true is explicitelly set in krb5.conf.
>
> Address in ticket causing problem, because ApacheDS check address in
> ticket with address of connection. And that leads to error "error 38
> Incorrect net address"
>
> I dont see this issue on IBM java and Active Directory, for instance, so I
> think it is not problem of client code.
>
> Also note that running ApacheDS with openJDK and oracle java I also don't
> see this.
>
> Only problematic combination is is ApacheDS vs. IBM java 8
>
> Tested use case is identity propagation / delegation.
>
> Any ideas?
>