|
 |
483b06 |
From 341d5790afb01e9d99c73ba336103e38e2b30091 Mon Sep 17 00:00:00 2001
|
|
|
483b06 |
From: Simo Sorce <simo@redhat.com>
|
|
|
483b06 |
Date: Mon, 22 May 2017 10:56:41 -0400
|
|
|
483b06 |
Subject: [PATCH] Fix rare race condition with missing ccache file
|
|
|
483b06 |
|
|
|
483b06 |
In some circumstances the ccache file may disappear while
|
|
|
483b06 |
mod_auth_gssapi still has a valid cookie and the client is performing a
|
|
|
483b06 |
json server call.
|
|
|
483b06 |
|
|
|
483b06 |
This may lead to credentials getting sourced from the keytab.
|
|
|
483b06 |
Make sure we enforce what GSS NAME we want to resolve so HTTP creds are
|
|
|
483b06 |
never mistakenly sourced.
|
|
|
483b06 |
|
|
|
483b06 |
Ticket: #6972
|
|
|
483b06 |
|
|
|
483b06 |
Signed-off-by: Simo Sorce <simo@redhat.com>
|
|
|
483b06 |
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
|
|
|
483b06 |
---
|
|
|
483b06 |
ipaserver/rpcserver.py | 11 ++++++++++-
|
|
|
483b06 |
1 file changed, 10 insertions(+), 1 deletion(-)
|
|
|
483b06 |
|
|
|
483b06 |
diff --git a/ipaserver/rpcserver.py b/ipaserver/rpcserver.py
|
|
|
483b06 |
index 4cde2815a0fe9332d67c84b531f573ff88b1a302..32f286148bbdf294f941116b4bdca85714a52837 100644
|
|
|
483b06 |
--- a/ipaserver/rpcserver.py
|
|
|
483b06 |
+++ b/ipaserver/rpcserver.py
|
|
|
483b06 |
@@ -777,8 +777,17 @@ class jsonserver_session(jsonserver, KerberosSession):
|
|
|
483b06 |
self.debug('no ccache, need login')
|
|
|
483b06 |
return self.need_login(start_response)
|
|
|
483b06 |
|
|
|
483b06 |
+ # If we have a ccache, make sure we have a GSS_NAME and use
|
|
|
483b06 |
+ # it to resolve the ccache name (Issue: 6972 )
|
|
|
483b06 |
+ principal = environ.get('GSS_NAME')
|
|
|
483b06 |
+ if principal is None:
|
|
|
483b06 |
+ self.debug('no GSS Name, need login')
|
|
|
483b06 |
+ return self.need_login(start_response)
|
|
|
483b06 |
+ gss_name = gssapi.Name(principal, gssapi.NameType.kerberos_principal)
|
|
|
483b06 |
+
|
|
|
483b06 |
# Redirect to login if Kerberos credentials are expired
|
|
|
483b06 |
- creds = get_credentials_if_valid(ccache_name=ccache_name)
|
|
|
483b06 |
+ creds = get_credentials_if_valid(name=gss_name,
|
|
|
483b06 |
+ ccache_name=ccache_name)
|
|
|
483b06 |
if not creds:
|
|
|
483b06 |
self.debug('ccache expired, deleting session, need login')
|
|
|
483b06 |
# The request is finished with the ccache, destroy it.
|
|
|
483b06 |
--
|
|
|
483b06 |
2.9.4
|
|
|
483b06 |
|