Branch: refs/heads/main
Home: https://github.com/gssapi/gssproxy
Commit: 66e7c5c5091fb392dbcd61d25ee2363f8b718403
https://github.com/gssapi/gssproxy/commit/66e7c5c5091fb392dbcd61d25ee2363f8…
Author: Steinar H. Gunderson <sesse(a)samfundet.no>
Date: 2025-02-11 (Tue, 11 Feb 2025)
Changed paths:
M src/gp_creds.c
Log Message:
-----------
Respect krb5_principal when impersonating
When doing impersonation, we need to get initial credentials
using some service principal from the given keytab. However,
since keytabs have no default principals, libgss just chooses
the first one in the file, which generally does not work well
when in Active Directory.
In particular, in AD, the only valid principal for authenticating
is SERVER$(a)EXAMPLE.ORG, whereas e.g. host/server.example.org(a)EXAMPLE.ORG
is just an SPN connected to SERVER$ and not valid for authenticating
in its own right. gssd will try SERVER$ first for its own purposes
(at least according to the man page), but when impersonating,
it will naturally ask for a ticket for a user (e.g. user(a)EXAMPLE.ORG)
and not the service principal itself.
This patch doesn't really make us choose the right principal for
AD purposes, but it makes us respect the krb5_principal configuration
option when getting a service principal for this purpose, so that
an administrator can at least manually select which one to use
without having to somehow reorder entries in the keytab (which appears
to be hard). Thus, the admin can set "krb5_principal = SERVER$(a)EXAMPLE.ORG"
in the service definition in gssproxy.conf, and it will work.
Signed-off-by: Steinar H. Gunderson <sesse(a)samfundet.no>
To unsubscribe from these emails, change your notification settings at https://github.com/gssapi/gssproxy/settings/notifications
Branch: refs/heads/main
Home: https://github.com/gssapi/gssproxy
Commit: 91c87d24bf844875701957f01552b674cced2ca8
https://github.com/gssapi/gssproxy/commit/91c87d24bf844875701957f01552b674c…
Author: Simo Sorce <simo(a)redhat.com>
Date: 2025-02-10 (Mon, 10 Feb 2025)
Changed paths:
M rpcgen/gp_xdr.h
M src/client/gpm_common.c
M src/gp_rpc_process.c
Log Message:
-----------
Change declaration of function map
Newer compilers complain if funciton is declared w/o arguments,
so we redeclare the xdrptoc_t as xdrfn and give it proper arguments
Signed-off-by: Simo Sorce <simo(a)redhat.com>
Commit: 01a9648cc6a6bd50695e4afd0baac278e557c1a9
https://github.com/gssapi/gssproxy/commit/01a9648cc6a6bd50695e4afd0baac278e…
Author: Simo Sorce <simo(a)redhat.com>
Date: 2025-02-10 (Mon, 10 Feb 2025)
Changed paths:
M .github/workflows/ci.yaml
Log Message:
-----------
Revamp and modernize the CI scripts
This is partially copied from the pkcs11-provider CI scripts which
instantiate conatiners to bring in more reasonable distro defaults and
properly check on multiple compilers
Signed-off-by: Simo Sorce <simo(a)redhat.com>
Compare: https://github.com/gssapi/gssproxy/compare/6874c569ee74...01a9648cc6a6
To unsubscribe from these emails, change your notification settings at https://github.com/gssapi/gssproxy/settings/notifications