File 0111-gssapi-assume-that-mechanism-from-acceptor... of Package krb5-mini

Overview Repositories Revisions Requests Users Attributes Meta

File 0111-gssapi-assume-that-mechanism-from-acceptor-credentia.patch of Package krb5-mini

From 28d6ffbaa49c11c43edca0085e0f7c9a0111ac88 Mon Sep 17 00:00:00 2001
From: HouzuoGuo <guohouzuo@gmail.com>
Date: Mon, 30 Oct 2017 11:21:57 +0100
Subject: [PATCH] gssapi: assume that mechanism from acceptor credential is
 Kerberos when environment variable GSSAPI_ASSUME_MECH_MATCH is set

The patch allows legacy applications (e.g. SAP Netweaver) to remain compatible
with newer Kerberos. System administrators who are experiencing this
kind of compatibility issues may set environment variable GSSAPI_ASSUME_MECH_MATCH
to a non-empty value, and make sure the environment variable is visible and effecvtive
to SAP Netweaver startup script.

There is no need to send the patch to upstream.

diff --git a/src/lib/gssapi/mechglue/g_accept_sec_context.c b/src/lib/gssapi/mechglue/g_accept_sec_context.c
index 8f2b7e4..9605cc1 100644
--- a/src/lib/gssapi/mechglue/g_accept_sec_context.c
+++ b/src/lib/gssapi/mechglue/g_accept_sec_context.c
@@ -210,7 +210,7 @@ gss_cred_id_t *		d_cred;
     /*
      * get the appropriate cred handle from the union cred struct.
      */
-    if (verifier_cred_handle != GSS_C_NO_CREDENTIAL) {
+    if (verifier_cred_handle != GSS_C_NO_CREDENTIAL && getenv("GSSAPI_ASSUME_MECH_MATCH") == NULL) {
 	input_cred_handle =
 	    gssint_get_mechanism_cred((gss_union_cred_t)verifier_cred_handle,
 				      selected_mech);
-- 
2.14.3

Places

File 0111-gssapi-assume-that-mechanism-from-acceptor-credentia.patch of Package krb5-mini

Places