[jboss-jira] [JBoss JIRA] (ELY-1373) IBM JDK, SPNEGO + FORM; with invalid ticket 200 status code is returned

[Jan Kalina (JIRA)]

    [ https://issues.jboss.org/browse/ELY-1373?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13480484#comment-13480484 ] 

Jan Kalina commented on ELY-1373:
---------------------------------

Ok, there is actually opposite issue - the Oracle behavior is wrong:

Currently when negotiation is done, but authorization fails, SPNEGO requests new negotiation, like when no negotiation was used. This can be problem, as it can cause infinite loop of trying to authenticate with the same unauthorized kerberos credential on client side - fallback mechanisms would not be used.

The fix should be, SPNEGO will not send bare challenge when authorization fails after completed negotiation - will send new PR.

> IBM JDK, SPNEGO + FORM; with invalid ticket 200 status code is returned
> -----------------------------------------------------------------------
>
>                 Key: ELY-1373
>                 URL: https://issues.jboss.org/browse/ELY-1373
>             Project: WildFly Elytron
>          Issue Type: Bug
>          Components: Authentication Mechanisms
>    Affects Versions: 1.2.0.Beta3
>            Reporter: Jan Kalina
>            Assignee: Jan Kalina
>
> Given SPNEGO + FORM authentication configuration. And running on IBM java.
> When invalid kerberos ticket is send 
> Then status code 200 is returned with http form. 
> While on Oracle JDK {{gssContext.isEstablished()}} returns true for invalid client ticket (negotiate with wrong domain JBOSS.COM), so SPNEGO mechanism sends bare challenge after failed authorization, on IBM JDK it returns false immediately, so mechanism fail without sending challenge - to be consistent should be send in both cases.



--
This message was sent by Atlassian JIRA
(v7.5.0#75005)