[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

SPNEGO bug in CFNetwork

Subject: SPNEGO bug in CFNetwork
From: Simon Spero <email@hidden>
Date: Mon, 13 Jun 2005 13:31:26 -0400
Delivered-to: email@hidden
Delivered-to: email@hidden

(filed as 4108189)

There's a silly bug that breaks SPNEGO GSSAPI authentication under Tiger. The correct service principal is "HTTP/<hostname>", but CFNetwork downcases the protocol name causing authentication to fail.

Could someone on the CFNetwork team check this out and see if this can be fixed before 10.4.2 goes final? PPC was easy, but I'll be darned if I'm porting this to x86 :-)

Patching the binary to uppercase the protocol name fixes authentication with both Safari and webdavfs.

<<16-May-2005 02:22 PM Simon Spero:
(I think last internet draft was http://meta.cesnet.cz/cms/opencms/en/docs/software/devel/draft-brezak-spnego-http-04.txt ).

4.1:
"   When the Kerberos Version 5 GSSAPI mechanism [RFC-1964] is being
   used, the HTTP server will be using a principal name of the form of
   "HTTP/<hostname>".
">>

Thanks

Simon

 _______________________________________________
Do not post admin requests to the list. They will be ignored.
Macnetworkprog mailing list      (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/macnetworkprog/email@hidden

This email sent to email@hidden

Follow-Ups:
- Re: SPNEGO bug in CFNetwork
  - From: Becky Willrich <email@hidden>

Prev by Date: Re: SCNetworkConnectionStart() Function for MAC OS Version <= 10_2
Next by Date: Re: SPNEGO bug in CFNetwork
Previous by thread: Re: SCNetworkConnectionStart() Function for MAC OS Version <= 10_2
Next by thread: Re: SPNEGO bug in CFNetwork
Index(es):
- Date
- Thread

Home