Skip to content

Improve the support of gssapi/sasl, fully realize wraptoken. #460

Open
@kirbyzhou

Description

@kirbyzhou

Now, wrapToken.go only supports Wrap Tokens v2 defined in

https://datatracker.ietf.org/doc/html/rfc4121#section-4.2.6
The Kerberos Version 5 GSS-API Mechanism: Version 2

for Backwards Compatibility Considerations, is should implement Wrap Tokens v1 defined in rfc1964
see https://datatracker.ietf.org/doc/html/rfc4121#section-6 for backword compatibility
see https://datatracker.ietf.org/doc/html/rfc1964#section-1.2.2 for old format

Now, if we encounter kerberos which use rc4, errors will happen like that:

2022/03/16 18:36:59 failed to init session context while performing kerberos authentication, err: wrong Token ID. Expected 0504, was 6030
2022/03/16 18:36:59 failed to authorize with kerberos, err: wrong Token ID. Expected 0504, was 6030, zookeeper server: kb01.sa:2181
2022/03/16 18:36:59 error in resending auth creds: wrong Token ID. Expected 0504, was 6030

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions