[jboss-jira] [JBoss JIRA] Created: (SECURITY-559) AdvancedLdapLoginModule: Service Principal is not constructed from java.naming.provider.url

[John Ruiz (JIRA)]

AdvancedLdapLoginModule: Service Principal is not constructed from java.naming.provider.url
-------------------------------------------------------------------------------------------

                 Key: SECURITY-559
                 URL: https://issues.jboss.org/browse/SECURITY-559
             Project: PicketBox (JBoss Security and Identity Management)
          Issue Type: Bug
      Security Level: Public (Everyone can see)
          Components: Negotiation
    Affects Versions: Negotiation_2.0.3.GA
         Environment: Windows Server 2008 R2 domain controller, Red Hat 5.5 Application Server (JBoss), Windows 7 Clients
            Reporter: John Ruiz
            Assignee: Darran Lofthouse
            Priority: Critical


When using org.jboss.security.negotiation.AdvancedLdapLoginModule chained with SPNEGO/Kerberos against Active Directory, the service principal specified in the TGS-REQ is ldap/foo.com, even though java.naming.provider.url is set to LDAP://dc1.foo.com.

Because of this, the /Secured test in the jboss-negotiation-toolkit will fail to bind to AD/LDAP because the KDC returns an error KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN.

The correct service principal name that the TGS-REQ should request is LDAP/dc1.foo.com because dc1.foo.com is what was provided in java.naming.provider.url.

-- 
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira