SPNEGO & IDP 3.2.1

[Koch, Ken]

Definitely, let me know if you want to make this an off-list conversation. I'm going to spin up a clone of the IDP into the ADDEV forest to see if that changes behavior. I don't think it will since the IDP says it's not pulling a principal at all from the SPNEGO. At this point, I've got no more data to go on. 


Ken, please can you provide us with more information?

- Which web browser do you use?
	Firefox for this ticket, also Chrome & IE 11 - All have the required settings for GSS via spnego
- May you test with a different browser?
	Let me know what you need.
- Does the problem always occur, or from time to time only?
	Always, but I'm in the proof of concept phase of SPNEGO. Never had a working instance to baseline.
- Does the problem occur for any user?
	Only tested my user. I'll reply with a different answer if other users work.
- Do you use SPNEGO login with other web applications (especially  non Microsoft ones), too, and it works there?
	I've never used SPNEGO anywhere.


My environment:
IDP Server:
- Windows 2012R2
- Jetty
- JDK 1.8 u52
- member of WUINFOSYS forest
- Keytab/principal for HTTP/logindev.wustl.edu at ACCOUNTSDEV.ADDEV.WUSTL.EDU
(of note, the logindev.wustl.edu is a CNAME to loadbalancer A records. The forward and reverse of logindev.wustl.edu are not the same and the IDP servername is not logindev.)

AD KDC Server:
- Windows 2012R2
- ADDEV forest
- Windows 2012R2 forest functional

-Ken

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Lutz
Sent: Friday, May 27, 2016 2:31 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: SPNEGO & IDP 3.2.1

Scott wrote:
> I do have this really vague memory of the SWITCH contingent mentioning 
> a condition like this to me. Like maybe the code didn't handle that 
> error case correctly initially and I needed to fix that, whereas I 
> thought if the GSS loop completed that the name extract step would be guaranteed to work (which I still would think, so I don't understand the issue).
> I can't find anything in the archive on it, so it might have been off list.

We (SWITCH) could reproduce a similar case during testing back then, but we couldn't find an explanation for the occurrence of the problem. (In the comment in the code mentioned by Scott, "observed" refers to this test case).

The problem occurred when the client had a valid Kerberos ticket, but the service for getting a "service ticket" was not available. Still, the browser
(Firefox) sent the ticket to the IdP, and the library processing the ticket seemed to accept this ticket. To be on the safe side, the IdP considers this situation as a failure.

Ken, please can you provide us with more information?

- Which web browser do you use?
  May you test with a different browser?
- Does the problem always occur, or from time to time only?
- Does the problem occur for any user?
- Do you use SPNEGO login with other web applications (especially
  non Microsoft ones), too, and it works there?

-Daniel

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net