File 0111-gssapi-assume-that-mechanism-from-acceptor... of Package krb5-mini

Overview Repositories Revisions Requests Users Attributes Meta

File 0111-gssapi-assume-that-mechanism-from-acceptor-credentia.patch of Package krb5-mini (Revision c62f2d9a05036cd1d89f7c77f0d893fc)

Currently displaying revision c62f2d9a05036cd1d89f7c77f0d893fc , Show latest

From af8921732b1babd08174133ab3728865a97593a1 Mon Sep 17 00:00:00 2001
From: HouzuoGuo <guohouzuo@gmail.com>
Date: Mon, 30 Oct 2017 11:21:57 +0100
Subject: [PATCH 1/2] gssapi: assume that mechanism from acceptor credential is
 Kerberos when environment variable GSSAPI_ASSUME_MECH_MATCH is set

The patch allows legacy applications (e.g. SAP Netweaver) to remain compatible
with newer Kerberos. System administrators who are experiencing this
kind of compatibility issues may set environment variable GSSAPI_ASSUME_MECH_MATCH
to a non-empty value, and make sure the environment variable is visible and effecvtive
to SAP Netweaver startup script.

There is no need to send the patch to upstream.
---
 src/lib/gssapi/mechglue/g_accept_sec_context.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/gssapi/mechglue/g_accept_sec_context.c b/src/lib/gssapi/mechglue/g_accept_sec_context.c
index 8f2b7e4..9605cc1 100644
--- a/src/lib/gssapi/mechglue/g_accept_sec_context.c
+++ b/src/lib/gssapi/mechglue/g_accept_sec_context.c
@@ -210,7 +210,7 @@ gss_cred_id_t *		d_cred;
     /*
      * get the appropriate cred handle from the union cred struct.
      */
-    if (verifier_cred_handle != GSS_C_NO_CREDENTIAL) {
+    if (verifier_cred_handle != GSS_C_NO_CREDENTIAL && getenv("GSSAPI_ASSUME_MECH_MATCH") == NULL) {
 	input_cred_handle =
 	    gssint_get_mechanism_cred((gss_union_cred_t)verifier_cred_handle,
 				      selected_mech);
-- 
2.16.2

Places

File 0111-gssapi-assume-that-mechanism-from-acceptor-credentia.patch of Package krb5-mini (Revision c62f2d9a05036cd1d89f7c77f0d893fc)

Places