[JBoss JIRA] (SECURITY-854) Fallback to FORM authentication when an invalid kerberos token is used
- First Post
- Replies
- Stats
-
Go to
- ----- 2026 -----
- July
- June
- May
- April
- March
- February
- January
- ----- 2025 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
[
https://issues.jboss.org/browse/SECURITY-854?page=com.atlassian.jira.plug...
]
Derek Horton updated SECURITY-854:
----------------------------------
Steps to Reproduce:
Get a token from a different KDC than what JBoss is configured to use. Hit a Negotiation
protected endpoint. This will result in a 401.
With the patch applied, it is possible to fallback to form authentication.
Git Pull Request: https://github.com/wildfly-security/jboss-negotiation/pull/19
Fallback to FORM authentication when an invalid kerberos token is
used
----------------------------------------------------------------------
Key: SECURITY-854
URL: https://issues.jboss.org/browse/SECURITY-854
Project: PicketBox
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Negotiation
Reporter: Derek Horton
Assignee: Derek Horton
Negotiation will not fallback to FORM authentication if the client has a kerberos token
from a different KDC than what JBoss is configured to use.
This results in the user getting presented with a 401 error and no way to login.
--
This message was sent by Atlassian JIRA
(v6.2.6#6264)
4357
days inactive
4357
days old
0 comments
1 participants
tags (0)
participants (1)
-
Derek Horton (JIRA)