Edit report at https://bugs.php.net/bug.php?id=76380&edit=1
ID: 76380
Updated by: [email protected]
Reported by: mike at flyn dot org
Summary: Error reporting from php-pecl-krb5 incomplete
-Status: Open
+Status: Closed
Type: Feature/Change Request
Package: PECL
Operating System: Linux
PHP Version: 7.2.6
-Assigned To:
+Assigned To: mbechler
Block user comment: N
Private report: N
New Comment:
Apparently fixed as of krb5 1.1.3.
Previous Comments:
------------------------------------------------------------------------
[2018-06-02 15:28:01] mbechler at eenterphace dot org
Hi,
thanks, good catch ... these cleanup functions were overwriting the minor_status. Should be fixed in SVN.
------------------------------------------------------------------------
[2018-05-27 00:12:33] mike at flyn dot org
Description:
------------
I have been configuring the Roundcube webmail system to authenticate using Kerberos, and I found myself doing some experiments to figure out a misconfiguration. The error reporting from php-pecl-krb5 was missing some key information that would have made this task easier.
I found the following in my logs:
May 26 13:37:18 herald roundcube: PHP Warning: GSSAPIContext::initSecContext(): Unspecified GSS failure. Minor code may provide more information (851968,2529639066) in /.../mail/program/lib/Roundcube/rcube_imap_generic.php on line 644
It seems the function which implements initSecContext() in gssapi.c does not print the error which returns from gss_init_sec_context(). Instead, it looks like the library prints no error until after the calls to gss_release_name() and gss_release_buffer(); this results in the ambiguous error above. Adding an error printing call immediately after gss_init_sec_context() allowed me to realize that the actual error was:
... Cannot find KDC for realm ...
This message made it much easier to realize that /etc/krb5.conf contained an error.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=76380&edit=1
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.