Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use SPNEGO mechanism by default (#41) #46

Merged
merged 1 commit into from
Jan 16, 2022
Merged

Use SPNEGO mechanism by default (#41) #46

merged 1 commit into from
Jan 16, 2022

Commits on Jan 16, 2022

  1. Use SPNEGO mechanism by default (pythongssapi#41) 

    Use the correct mechanism as described by
* RFC 4559, section 4: The "Negotiate" auth-scheme calls for the use of SPNEGO
  GSSAPI tokens that the specific mechanism type specifies.
* RFC 4178, section 3.2: The GSS-API initiator invokes GSS_Init_sec_context()
  as normal, but requests that SPNEGO be used. SPNEGO can either be explicitly
  requested or accepted as the default mechanism.

Since both MIT Kerberos and Heimdal use Kerberos 5 as their default mechanism
we must explicitly request SPNEGO. Passing raw Kerberos tokens to the acceptor
is a violation of these RFCs and some implementations complain about, thus they
always need to be wrapped.

This closes pythongssapi#41

Signed-off-by: Michael Osipov <michael.osipov@siemens.com>
    @michael-o
    michael-o committed Jan 16, 2022
    Configuration menu
    Copy the full SHA
    8718e78 View commit details
    Browse the repository at this point in the history