Re: gss_init_sec_context
Frediano Ziglio <[email protected]>
| Newsgroups | gmane.comp.db.tds.freetds |
|---|---|
| Message-ID | <[email protected]> |
2011/6/25 <[email protected]>: > On Thu, Jun 23, 2011 at 04:16:13PM -0400, [email protected] wrote: >> http://www.gnu.org/software/gss/manual/html_node/Context_002dLevel-Routines.html >> >> In src/tds/gssapi.c::tds_gss_continue(), I think we may be calling >> gss_init_sec_context() incorrectly. > ... >> The manual says the call should be in a loop > > Well, the manual *does* say that, but more verbose error logging, recently > committed, shows the error is "mechanism specific": > > net.c:602:Received packet > 0000 04 01 00 25 00 00 01 00-00 00 15 00 06 01 00 1b |...%.... ........| > 0010 00 01 02 00 1c 00 01 03-00 1d 00 00 ff 09 00 0f |........ ........| > 0020 c3 00 00 02 00 - |.....| > > login.c:1090:detected flag 2 > login.c:766:using tds_gss_get_auth authentication for [no name] account > gssapi.c:206:tds_gss_get_auth: kerberos name [foo]:1433 > gssapi.c:284:gss_init_sec_context: min_stat 2529638944 "Unknown code krb5 32" > gssapi.c:324:gss_init_sec_context: GSS_S_FAILURE: The routine failed for > reasons that are not defined at the GSS level. > gssapi.c:218:tds_gss_get_auth: maj_stat==0, tds_gss_continue returned 0 > login.c:464:login packet rejected > > I don't know how to decode the minor status. Suggestions? > Strange error... which kerberos library are you using? Are you sure you are not using an header and a wrong library? Machine iime and klist are ok? > Also, I tried to get the actual_mechanism; we currently pass a NULL because > don't use the feedback. I'm apparently using Kerberos krb5-devel-1.6.1, and it > only ever sets that pointer to NULL. Suggestions? > I try to find the strange number and I found a "unknown mech" > Last point: when Kerberos logins fail, we should report TDSENEG to signify > login negotiation failed. Instead, tds_connect() reports TDSEFCON, > "Adaptive Server connection failed", which is *not* true. because > tds_connect() and the various tds..._login functions return only TDS_FAIL. > That needs unravelling. > freddy77 _______________________________________________ FreeTDS mailing list [email protected] http://lists.ibiblio.org/mailman/listinfo/freetds