You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2011/04/21 11:11:34 UTC
DO NOT REPLY [Bug 51099] New: SPNEGO loginConfigName does not work
https://issues.apache.org/bugzilla/show_bug.cgi?id=51099
Summary: SPNEGO loginConfigName does not work
Product: Tomcat 7
Version: trunk
Platform: All
OS/Version: All
Status: NEW
Severity: normal
Priority: P2
Component: Catalina
AssignedTo: dev@tomcat.apache.org
ReportedBy: markt@apache.org
As reported by fhanik on the dev list:
2. com.sun.security.jgss.krb5.accept is not configurable
While the authenticator has the attribute loginConfigName, there seems to be a
place in the code where it omits this entry.
renaming this entry in jaas.conf and setting the loginConfigName will fail to
validate a ticket
The problem code is here:
gssContext = manager.createContext(manager.createCredential(null,
GSSCredential.DEFAULT_LIFETIME,
new Oid("1.3.6.1.5.5.2"),
GSSCredential.ACCEPT_ONLY));
should look like
final GSSManager manager = GSSManager.getInstance();
final PrivilegedExceptionAction<GSSCredential> action =
new PrivilegedExceptionAction<GSSCredential>() {
public GSSCredential run() throws GSSException {
return manager.createCredential(null,
GSSCredential.DEFAULT_LIFETIME,
new Oid("1.3.6.1.5.5.2"),
GSSCredential.ACCEPT_ONLY);
}
};
gssContext = manager.createContext(Subject.doAs(lc.getSubject(),
action));||
best
Filip
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51099] SPNEGO loginConfigName does not work
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51099
--- Comment #4 from Gerard Borst <ge...@hotmail.com> 2011-05-06 09:39:54 UTC ---
Just trying to help.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51099] SPNEGO loginConfigName does not work
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51099
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |FIXED
--- Comment #3 from Mark Thomas <ma...@apache.org> 2011-05-05 18:48:30 UTC ---
That is a separate issue that does not belong as part of this issue. To be
perfectly honest, reports along the lines of "this might be a bug, I'm not
sure" are just going to get closed as invalid.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51099] SPNEGO loginConfigName does not work
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51099
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
--- Comment #1 from Mark Thomas <ma...@apache.org> 2011-05-04 21:47:16 UTC ---
Patch was spot on. Cheers Filip.
Applied to 7.0.x. Will be in 7.0.13 onwards.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51099] SPNEGO loginConfigName does not work
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51099
Gerard Borst <ge...@hotmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|FIXED |
--- Comment #2 from Gerard Borst <ge...@hotmail.com> 2011-05-05 17:51:54 UTC ---
I think it looks very good and I'm very interested because I use a spnego
filter at this moment, but I think the JAAS login and the creation of the
gssmanager should be in a constructor or in this case possibly in the
initInternal. This the JAAS login of the server and should be done only once.
At least I think so, maybe I'm wrong, it's a complex subject.
I'm talking about this part:
try {
lc = new LoginContext(getLoginConfigName());
lc.login();
} catch (LoginException e) {
log.error(sm.getString("spnegoAuthenticator.serviceLoginFail"),
e);
response.sendError(
HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
return false;
}
// Assume the GSSContext is stateless
// TODO: Confirm this assumption
final GSSManager manager = GSSManager.getInstance();
Met vriendelijke groet,
Gerard
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org