Re: [Broken test case] Cryptic error message, fallback handling issue

Glad to help.

However I may have derailed a request from Love for some debugging information.  The fact that Heimdal crashed, while MIT didn't in your first attempt still indicates something that ought to be fixed.  If you have the time to respond to Love's request, we would all benefit.

On Jan 18, 2012, at 5:19 PM, Stephane LAPIE wrote:

> On 01/12/2012 05:38 PM, Henry B. Hotz wrote:
>> 
>> On Jan 11, 2012, at 11:29 PM, Stephane LAPIE wrote:
>> 
>>> Thanks for the good practices, I'll admit I sorely lack in that. :)
>>> 
>>> I am actually already using a dedicated keytab for apache (because yes,
>>> I am fully aware "host" and "HTTP" services are two different things,
>>> and thus require different permissions, enforced by my deployment tools :)).
>>> 
>>> I am aware most of my woes stem from the non-removable requirement to
>>> have stuff run from AD and a Windows environment, and the fact IE uses
>>> the Windows Unified Authentication mechanism which is far more thorough
>>> than other environments : i.e it will only accept authentication if the
>>> hostname returned by an rDNS lookup matches the principal of the server,
>>> and I wanted to eliminate unknowns.
>>> 
>>> I ended up forcing the SPN after wasting some time because the server
>>> was advertising "HTTP/<ApacheServerName>" (which is apparently what you
>>> get when using only "KrbServiceName HTTP", and ServerName is acquired
>>> from rDNS of the local IP) which didn't reflect the vhost
>>> "<ApplicationName>", and made authentication fail from IE when it found
>>> out the URL didn't match the SPN.
>>> 
>>> This actually kind of brings the question : what is the best practice
>>> with apache+vhosts and Kerberos ?
>>> 
>>> Should I just forget the idea altogether and go with
>>> "http://webserver.domain/application/" instead of
>>> "http://application.domain/" ?
>> 
>> Well, if you need to support multiple server names (e.g. virtual hosts), then what I recommended is probably the only way it works.  Add in that different OSs and browsers (and versions?) might have different algorithms for how they construct a principal name from the user-input server name AND that you need to support all of them, and you might have quite a list of names to support.
> 
> It turns out using "Any" as service name in apache, and having
> HTTP/<vhost> and HTTP/<mainhost> loaded in the apache keytab works just
> fine !
> 
> Thanks again for your time and your advice. :)
> -- 
> Stephane LAPIE, EPITA SRS, Promo 2005
> "Even when they have digital readouts, I can't understand them."
> --MegaTokyo
> 

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email protected], or [email protected]