Re: SPNEGO bug in CFNetwork

Subject: Re: SPNEGO bug in CFNetwork

From: Becky Willrich <email@hidden>

Date: Mon, 13 Jun 2005 11:21:36 -0700

Delivered-to: email@hidden

I looked at the bug - looks like the spec sez that string should be case-insensitive. Where precisely is this failing? That is, what server is requiring precisely the uppercase string?

Thanks - REW

On Jun 13, 2005, at 10:31 AM, Simon Spero wrote:

(filed as 4108189)

There's a silly bug that breaks SPNEGO GSSAPI authentication under Tiger. The correct service principal is "HTTP/<hostname>", but CFNetwork downcases the protocol name causing authentication to fail.

Could someone on the CFNetwork team check this out and see if this can be fixed before 10.4.2 goes final? PPC was easy, but I'll be darned if I'm porting this to x86 :-)

Patching the binary to uppercase the protocol name fixes authentication with both Safari and webdavfs.

<<16-May-2005 02:22 PM Simon Spero:
(I think last internet draft was http://meta.cesnet.cz/cms/opencms/en/docs/software/devel/draft-brezak-spnego-http-04.txt ).

4.1:
"   When the Kerberos Version 5 GSSAPI mechanism [RFC-1964] is being
   used, the HTTP server will be using a principal name of the form of
   "HTTP/<hostname>".
">>

Thanks

Simon

_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macnetworkprog mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/macnetworkprog/email@hidden

This email sent to email@hidden

_______________________________________________ Do not post admin requests to the list. They will be ignored. Macnetworkprog mailing list (email@hidden) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/macnetworkprog/email@hidden This email sent to email@hidden

Follow-Ups:

Re: SPNEGO bug in CFNetwork
- From: Simon Spero <email@hidden>

References:

>SPNEGO bug in CFNetwork (From: Simon Spero <email@hidden>)