You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hc.apache.org by "Ulrich Colby (JIRA)" <ji...@apache.org> on 2017/10/05 16:45:01 UTC
[jira] [Comment Edited] (HTTPCLIENT-1873) Kerberos delegation no
longer working after HTTPCLIENT-1736 patch in version 4.5.3
[ https://issues.apache.org/jira/browse/HTTPCLIENT-1873?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16193165#comment-16193165 ]
Ulrich Colby edited comment on HTTPCLIENT-1873 at 10/5/17 4:44 PM:
-------------------------------------------------------------------
@Oleg,
I understand and I agree. Since most Kerberos related options in Java are configurable through System environment variables, then if you're okay with it, I was going to code/submit a PR that checks whether a System.getenv variable is set or not, i.e.: "org.apache.httpclient.auth.spnego.requestcreddeleg" [true,false] or left undefined. Let me know if that's acceptable with you.
was (Author: ulrichcolby):
@Oleg,
I understand and I agree. Since most Kerberos related options in Java are configurable through System environment variables. If you're okay with it, I was going to code/submit a PR that checks whether a System.getenv variable is set or not, i.e.: "org.apache.httpclient.auth.spnego.requestcreddeleg" [true,false] or left undefined. Let me know if that's acceptable with you.
> Kerberos delegation no longer working after HTTPCLIENT-1736 patch in version 4.5.3
> ----------------------------------------------------------------------------------
>
> Key: HTTPCLIENT-1873
> URL: https://issues.apache.org/jira/browse/HTTPCLIENT-1873
> Project: HttpComponents HttpClient
> Issue Type: Bug
> Components: HttpClient (classic), HttpClient (Windows)
> Affects Versions: 4.5.3, 4.5.4
> Environment: Windows,Linux
> Reporter: Ulrich Colby
> Priority: Minor
> Labels: easyfix
> Original Estimate: 2h
> Remaining Estimate: 2h
>
> In version 4.5.3, the following fix got applied to the httpclient library:
> _ [HTTPCLIENT-1736] do not request cred delegation by default when using Kerberos auth.
> Contributed by Oleg Kalnichevski <olegk at apache.org>_
> Although it says "by default", when looking at the affected code it's not the case (i.e.: there is no way to request if we want it). From our tests and my understanding of Kerberos, if a user account is not allowed to be used for delegation, then you can still request delegation, but when creating the user token, it'll simply not be applied.
> +Affected area+:
> In the class "GSSSchemeBase", in the method "createGSSContext", we need the following line added back:
> *gssContext.requestCredDeleg(true);*
> **OR**
> If you insist of leaving it off for a reason I'm not aware of, having a way, maybe through a system property, to say that we want it.
> _IMHO, one of the main reason for using Kerberos in an enterprise environment is to be able to make use of delegation (double hop scenarios)._
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org