linux/net/sunrpc/auth_gss
J. Bruce Fields 414ca017a5 nfsd4: fix gss-proxy 4.1 mounts for some AD principals
The principal name on a gss cred is used to setup the NFSv4.0 callback,
which has to have a client principal name to authenticate to.

That code wants the name to be in the form servicetype@hostname.
rpc.svcgssd passes down such names (and passes down no principal name at
all in the case the principal isn't a service principal).

gss-proxy always passes down the principal name, and passes it down in
the form servicetype/hostname@REALM.  So we've been munging the name
gss-proxy passes down into the format the NFSv4.0 callback code expects,
or throwing away the name if we can't.

Since the introduction of the MACH_CRED enforcement in NFSv4.1, we've
also been using the principal name to verify that certain operations are
done as the same principal as was used on the original EXCHANGE_ID call.

For that application, the original name passed down by gss-proxy is also
useful.

Lack of that name in some cases was causing some kerberized NFSv4.1
mount failures in an Active Directory environment.

This fix only works in the gss-proxy case.  The fix for legacy
rpc.svcgssd would be more involved, and rpc.svcgssd already has other
problems in the AD case.

Reported-and-tested-by: James Ralston <ralston@pobox.com>
Acked-by: Simo Sorce <simo@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
2015-11-24 11:36:31 -07:00
..
auth_gss.c sunrpc: avoid warning in gss_key_timeout 2015-10-23 15:57:28 -04:00
gss_generic_token.c sunrpc: eliminate RPC_DEBUG 2014-11-24 17:31:46 -05:00
gss_krb5_crypto.c sunrpc: use sg_init_one() in krb5_rc4_setup_enc/seq_key() 2015-06-22 14:15:06 -04:00
gss_krb5_keys.c sunrpc: eliminate RPC_DEBUG 2014-11-24 17:31:46 -05:00
gss_krb5_mech.c sunrpc: eliminate RPC_DEBUG 2014-11-24 17:31:46 -05:00
gss_krb5_seal.c sunrpc: eliminate RPC_DEBUG 2014-11-24 17:31:46 -05:00
gss_krb5_seqnum.c sunrpc: eliminate RPC_DEBUG 2014-11-24 17:31:46 -05:00
gss_krb5_unseal.c sunrpc: eliminate RPC_DEBUG 2014-11-24 17:31:46 -05:00
gss_krb5_wrap.c sunrpc: eliminate RPC_DEBUG 2014-11-24 17:31:46 -05:00
gss_mech_switch.c sunrpc: eliminate RPC_DEBUG 2014-11-24 17:31:46 -05:00
gss_rpc_upcall.c nfsd4: fix gss-proxy 4.1 mounts for some AD principals 2015-11-24 11:36:31 -07:00
gss_rpc_upcall.h Merge branch 'nfs-for-next' of git://linux-nfs.org/~trondmy/nfs-2.6 into for-3.10 2013-04-29 16:23:34 -04:00
gss_rpc_xdr.c svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures 2015-05-04 12:02:40 -04:00
gss_rpc_xdr.h sunrpc: eliminate RPC_DEBUG 2014-11-24 17:31:46 -05:00
Makefile SUNRPC: Add RPC based upcall mechanism for RPCGSS auth 2013-04-26 11:41:27 -04:00
svcauth_gss.c sunrpc: integer underflow in rsc_parse() 2015-02-26 15:40:16 -05:00