Dominic Hargreaves <[email protected]> writes: > On Sun, Mar 14, 2010 at 02:15:51PM -0700, Russ Allbery wrote:
>> Unfortunately, Cyrus SASL doesn't do this. It still builds a >> server-side principal name and then accepts only that principal name. >> We use a one-line patch to Cyrus SASL to disable that behavior. I >> suspect that's what you ran into, since the Cyrus SASL default server >> principal is based on the canonical local hostname. > Thank you for the excellent explanation. I would be very interested in > details of the Cyrus patch you have. Has it been offered upstream at > all? We took it from recent discussion on the Heimdal list, where people said that they'd offered it upstream several times. We haven't tried again ourselves. The patch is attached to this message; it's completely trivial. > So, just to clarify, the original Net::LDAP (without my bad patch) would > have worked with your DNS round-robin based service? Correct. We noticed this because it was working with etch and broke under lenny. -- Russ Allbery ([email protected]) <http://www.eyrie.org/~eagle/>
diff --git a/debian/changelog b/debian/changelog index 1d7beaa..214954d 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,10 @@ +cyrus-sasl2 (2.1.23.dfsg1-5~sbp50+2) unstable; urgency=low + + * Allow acquisition of credentials with service principal from + any host. + + -- Bill MacAllister <[email protected]> Tue, 16 Feb 2010 00:17:26 -0800 + cyrus-sasl2 (2.1.23.dfsg1-5~sbp50+1) unstable; urgency=low * Backport. diff --git a/plugins/gssapi.c b/plugins/gssapi.c index d19a6c2..fcfa2ea 100644 --- a/plugins/gssapi.c +++ b/plugins/gssapi.c @@ -693,7 +693,7 @@ gssapi_server_mech_step(void *conn_context, GSS_LOCK_MUTEX(params->utils); maj_stat = gss_acquire_cred(&min_stat, - text->server_name, + GSS_C_NO_NAME, GSS_C_INDEFINITE, GSS_C_NO_OID_SET, GSS_C_ACCEPT,
