[JBoss JIRA] (ELY-1328) Unable to use GS2-KRB5-PLUS SASL mechanism - AP_REQ token id does not match
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-1328?page=com.atlassian.jira.plugin.s... ]
Darran Lofthouse updated ELY-1328:
----------------------------------
Fix Version/s: 1.2.0.Beta1
> Unable to use GS2-KRB5-PLUS SASL mechanism - AP_REQ token id does not match
> ---------------------------------------------------------------------------
>
> Key: ELY-1328
> URL: https://issues.jboss.org/browse/ELY-1328
> Project: WildFly Elytron
> Issue Type: Bug
> Reporter: Josef Cacek
> Assignee: Farah Juma
> Priority: Blocker
> Fix For: 1.1.0.CR6, 1.2.0.Beta1
>
>
> Invalid initial token is used on server for *GS2-KRB5-PLUS* SASL mechanism. The {{Gs2SaslServer}} uses a GSSContext to accept the token. It expects AP_REQ is comming (*{{AP_REQ_ID=256}}*), but the incomming tokenId has value *{{669}}* (value of first 2 bytes of token body).
> Setting blocker as this mechanism is required by EAP7-530 and EAP7-142.
> Following exception is thrown:
> {noformat}
> GSSException: Defective token detected (Mechanism level: AP_REQ token id does not match!)
> at sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:96)
> at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:829)
> at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)
> at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
> at org.wildfly.security.sasl.gs2.Gs2SaslServer.evaluateMessage(Gs2SaslServer.java:212)
> at org.wildfly.security.sasl.util.AbstractSaslParticipant.evaluateMessage(AbstractSaslParticipant.java:180)
> at org.wildfly.security.sasl.util.AbstractSaslServer.evaluateResponse(AbstractSaslServer.java:52)
> at org.wildfly.security.sasl.util.AuthenticationCompleteCallbackSaslServerFactory$1.evaluateResponse(AuthenticationCompleteCallbackSaslServerFactory.java:58)
> at org.wildfly.security.sasl.util.AuthenticationTimeoutSaslServerFactory$DelegatingTimeoutSaslServer.evaluateResponse(AuthenticationTimeoutSaslServerFactory.java:106)
> at org.wildfly.security.sasl.util.SecurityIdentitySaslServerFactory$1.evaluateResponse(SecurityIdentitySaslServerFactory.java:57)
> at org.xnio.sasl.SaslUtils.evaluateResponse(SaslUtils.java:245)
> at org.xnio.sasl.SaslUtils.evaluateResponse(SaslUtils.java:217)
> at org.jboss.remoting3.remote.ServerConnectionOpenListener$AuthStepRunnable.run(ServerConnectionOpenListener.java:486)
> at org.jboss.remoting3.EndpointImpl$TrackingExecutor.lambda$execute$0(EndpointImpl.java:898)
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:748)
> {noformat}
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 9 months
[JBoss JIRA] (ELY-1330) Elytron GS2-KRB5 SASL mechanism (non-PLUS) is allowed even if the channel binding is possible
by Darran Lofthouse (JIRA)
[ https://issues.jboss.org/browse/ELY-1330?page=com.atlassian.jira.plugin.s... ]
Darran Lofthouse updated ELY-1330:
----------------------------------
Fix Version/s: 1.2.0.Beta1
> Elytron GS2-KRB5 SASL mechanism (non-PLUS) is allowed even if the channel binding is possible
> ---------------------------------------------------------------------------------------------
>
> Key: ELY-1330
> URL: https://issues.jboss.org/browse/ELY-1330
> Project: WildFly Elytron
> Issue Type: Bug
> Reporter: Josef Cacek
> Assignee: Farah Juma
> Priority: Blocker
> Fix For: 1.1.0.CR6, 1.2.0.Beta1
>
>
> Using GS2-KRB5-PLUS mechanism should be forced when channel binding is possible (server-ssl-context is used) and GS2-KRB5 should not be allowed in such case.
> Currently the GS2-KRB5 authentication passes even if the SSL server context is used (channel binding possible).
> This is a follow up to JBEAP-11396 and JBEAP-12231 which were aimed on SCRAM PLUS mechanisms. Most of the related discussion takes place on JBEAP-11396.
--
This message was sent by Atlassian JIRA
(v7.2.3#72005)
8 years, 9 months