Re: SPNEGO bug in CFNetwork
Re: SPNEGO bug in CFNetwork
- Subject: Re: SPNEGO bug in CFNetwork
- From: Scooter Morris <email@hidden>
- Date: Fri, 30 Sep 2005 21:20:11 -0700
We really need a fix for this problem! The problem is pretty clear,
the CFNetwork layer is assuming that the scheme (e.g. ftp, http, https)
can be mapped directly into a service principal. This works for ftp,
but not for http (they test for and drop the 's'). Here is a
patch:
--- CFHTTPAuthentication.c 2005-09-30 21:09:05.118012864 -0700
+++ CFHTTPAuthentication.c.fixed 2005-09-30 21:11:30.516734591
-0700
@@ -2052,16 +2052,19 @@
UInt8* hostname =
_CFStringGetOrCreateCString(alloc, host, buf1, &len,
kCFStringEncodingASCII);
UInt8* servicetype;
len = sizeof(buf2);
servicetype =
_CFStringGetOrCreateCString(alloc, scheme, buf2, &len,
kCFStringEncodingASCII);
if (!strcmp(servicetype, "https"))
servicetype[4] = '\0';
+
+ if (!strcmp(servicetype, "http"))
+ strcpy(servicetype, "HTTP");
if (!GetSvcTicketForHost(hostname, servicetype,
&tktLen, &ticket)) {
result->_preferred = current_scheme;
}
if (hostname != buf1)
CFAllocatorDeallocate(alloc, hostname);
All this does is check for "http" and maps it to "HTTP" before calling
GetSvcTicketForHost. I believe that this will fix the problem
and not have any deleterious impact.
-- scooter
Becky Willrich wrote:
I looked at the bug - looks like the spec sez
that string should be case-insensitive. Where precisely is this
failing? That is, what server is requiring precisely the uppercase
string?
Becky -
Kerberos 5 principal names are normally case sensitive. Just about
every other server principal uses a lower case service name; SPNEGO is
the odd one out. In fact the earliest versions of the SPNEGO drafts did
specify http/<hostname>; however this was broken in later drafts,
and in deployed code.
Simple explanation of the normal convention in the java docs here: http://java.sun.com/j2se/1.5.0/docs/guide/security/jgss/tutorials/KerberosReq.html
SPNEGO 'spec' :
<<
[....]
1. Create the SPNs associated with this account on the KDC:
setspn—A host/mysrvr.proseware.com mysrvr
setspn—A HTTP/mysrvr.proseware.com mysrvr
*Note* Use upper-case "HTTP" to match the
way Internet
Explorer builds SPNs. Alternatively, you can run ktpass (as
shown below) to create the SPNs. When using the "*-princ*"
option of ktpass, you are specifying the Kerberos
>>
Kitten hasn't changed this, because it would break the installed base.
|
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macnetworkprog mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden