Bug#526361: libsasl2-modules-gssapi-heimdal: GSSAPI with heimdal kerberos5 doesn't work

[Friedemann Stoyan]

Package: libsasl2-modules-gssapi-heimdal
Version: 2.1.22.dfsg1-23
Severity: important

Dear Maintainers,

I have noticed that GSSAPI with heimdal kerberos5 doesn't work. This happens
with OpenLDAP (slapd) but can be reproduced with
sasl-sample-server/sasl-sample-client too. This behavior is caused by
missformed kerberos ticket-granting principals.

Heimdal Kerberos with this configurtion:

fsn at reliant:~$ verify_krb5_conf --dumpconfig
[logging]
    kdc = FILE:/var/log/heimdal-kdc.log
[libdefaults]
    default_realm = LAB.SWAPON.DE
    default_cc_name = KCM:%{uid}
    fcc-mit-ticketflags = true
[realms]
    LAB.SWAPON.DE = {
        kdc = kerberos.lab.swapon.de
        admin_server = kerberos.lab.swapon.de
    }
[domain_realm]
    .lab.swapon.de = LAB.SWAPON.DE

Some sasl testing with sasl-sample-server/sasl-sample-client:
(Client/Server responses are stripped down)

SASL-Server:
fsn at reliant:~$ KRB5_KTNAME=/etc/krb5.keytab sasl-sample-server -m GSSAPI -s host
Forcing use of mechanism GSSAPI
Sending list of 1 mechanism(s)
S: R1NTQVBJ
Waiting for client mechanism...
C: R1NTOMIJgcO7AQjce5X2dQ3LbDPjzH0X6....
got 'GSSAPI'
Sending response...
S: Y1t/wIJcL+vyjBcNTZdcmmeJznmv7XmxDdpzBsdtOblGbcnSOrn8w==
Waiting for client reply...

SASL-Client:
fsn at reliant:~$ KRB5_KTNAME=/etc/krb5.keytab sasl-sample-client -s host -m GSSAPI -n reliant.lab.swapon.de
service=host
Waiting for mechanism list from server...
S: R1NTQVBJrecieved 6 byte message
Forcing use of mechanism GSSAPI
Choosing best mechanism from: GSSAPI
Using mechanism GSSAPI
Preparing initial.
Sending initial response...
C: R1NTOMIJgcO7AQjce5X2dQ3LbDPjzH0X6....
Waiting for server reply...

>From special interest is the KDC Logfile:

--> Authentication Server Request: OK
2009-04-30T09:44:25 AS-REQ host/reliant.lab.swapon.de at LAB.SWAPON.DE from IPv6:2001:6f8:12ec:11::88:fefe for krbtgt/LAB.SWAPON.DE at LAB.SWAPON.DE
2009-04-30T09:44:25 Client sent patypes: encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp, encrypted-timestamp
2009-04-30T09:44:25 Looking for PKINIT pa-data -- host/reliant.lab.swapon.de at LAB.SWAPON.DE
2009-04-30T09:44:25 Looking for ENC-TS pa-data -- host/reliant.lab.swapon.de at LAB.SWAPON.DE
2009-04-30T09:44:25 ENC-TS Pre-authentication succeeded -- host/reliant.lab.swapon.de at LAB.SWAPON.DE using aes256-cts-hmac-sha1-96
2009-04-30T09:44:25 Client supported enctypes: aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha1-96, des3-cbc-sha1, des3-cbc-md5, arcfour-hmac-md5, des-cbc-md5, des-cbc-md4, des-cbc-crc
2009-04-30T09:44:25 Using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
2009-04-30T09:44:25 AS-REQ authtime: 2009-04-30T09:44:25 starttime: unset endtime: 2009-04-30T19:44:25 renew till: unset
2009-04-30T09:44:25 sending 670 bytes to IPv6:2001:6f8:12ec:11::88:fefe


--> Ticket Granting Server Request: Fails
2009-04-30T09:44:25 TGS-REQ host/reliant.lab.swapon.de at LAB.SWAPON.DE from IPv6:2001:6f8:12ec:11::88:fefe for digest/RELIANT at LAB.SWAPON.DE [canonicalize]
2009-04-30T09:44:25 Searching referral for RELIANT
2009-04-30T09:44:25 Server not found in database: digest/RELIANT at LAB.SWAPON.DE: No such entry in the database
2009-04-30T09:44:25 Failed building TGS-REP to IPv6:2001:6f8:12ec:11::88:fefe
2009-04-30T09:44:25 sending 107 bytes to IPv6:2001:6f8:12ec:11::88:fefe
2009-04-30T09:44:25 TGS-REQ host/reliant.lab.swapon.de at LAB.SWAPON.DE from IPv6:2001:6f8:12ec:11::88:fefe for krbtgt/RELIANT at LAB.SWAPON.DE
2009-04-30T09:44:25 Server not found in database: krbtgt/RELIANT at LAB.SWAPON.DE: No such entry in the database
2009-04-30T09:44:25 Failed building TGS-REP to IPv6:2001:6f8:12ec:11::88:fefe
2009-04-30T09:44:25 sending 107 bytes to IPv6:2001:6f8:12ec:11::88:fefe

The kerberos ticket-granting request realm "krbtgt/RELIANT at LAB.SWAPON.DE"
is completly false. Correct is: "krbtgt/LAB.SWAPON.DE at LAB.SWAPON.DE".

KRB5_KTNAME=/etc/krb5.keytab sasl-sample-server -m GSSAPI -s host -d LAB.SWAPON.DE
produces:

2009-04-30T09:54:03 TGS-REQ host/reliant.lab.swapon.de at LAB.SWAPON.DE from IPv6:2001:6f8:12ec:11::88:fefe for krbtgt/SWAPON at LAB.SWAPON.DE
2009-04-30T09:54:03 Server not found in database: krbtgt/SWAPON at LAB.SWAPON.DE: No such entry in the database
2009-04-30T09:54:03 Failed building TGS-REP to IPv6:2001:6f8:12ec:11::88:fefe
2009-04-30T09:54:03 sending 107 bytes to IPv6:2001:6f8:12ec:11::88:fefe

which is not correct too.

At present I have no clue how to fix this. Good ideas would be
appreciated.

Regards
Friedemann

-- System Information:
Debian Release: 5.0.1
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.26-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages libsasl2-modules-gssapi-heimdal depends on:
ii  libasn1-8-heimdal       1.2.dfsg.1-2.1   Heimdal Kerberos - ASN.1 library
ii  libc6                   2.7-18           GNU C Library: Shared libraries
ii  libcomerr2              1.41.3-1         common error description library
ii  libgssapi2-heimdal      1.2.dfsg.1-2.1   Heimdal Kerberos - GSSAPI support 
ii  libkrb5-25-heimdal      1.2.dfsg.1-2.1   Heimdal Kerberos - libraries
ii  libroken18-heimdal      1.2.dfsg.1-2.1   Heimdal Kerberos - roken support l
ii  libsasl2-modules        2.1.22.dfsg1-23  Cyrus SASL - pluggable authenticat
ii  libssl0.9.8             0.9.8g-15+lenny1 SSL shared libraries

libsasl2-modules-gssapi-heimdal recommends no packages.

libsasl2-modules-gssapi-heimdal suggests no packages.

-- no debconf information