Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8256659

Incorrect parsing of krb5 username

XMLWordPrintable

      Kerberos app regression. Works on Oracle 8u261 but fails on Oracle 8u271

      We upgraded java jdk from 1.8-261 to 1.8-271 on an application server (RedHat
      Enterprise Linux 7) running EAP Jboss 7.1.6 and since that the Kerberos
      authentication with AD has issues. In the process a string parsing seems not
      work correctly.

      I compared the log entries on the security with java 1.8.261 vs. 1.8.271 and
      I stumbled on the following issue:

      Java 1.8.261:
      - [org.jboss.security.auth.spi.AbstractServerLoginModule][login] Storing
      username 'TESTUSER' and empty password

      Java 1.8.271:
      - [org.jboss.security.auth.spi.AbstractServerLoginModule][login] Storing
      username 'TESTUSER\' and empty password

      The "\" seems to be bug on my perspective on their implementation of the
      AdvanceLdapLogin Module or similar. The system cannot find the username with
      an ending "\" on the ldap server.

      We set debug to true on Krb5LoginModule and set the system properties
      sun.security.krb5.debug=true and sun.security.spnego.debug=true
      Please find attached the krb5.conf and the logs.

            coffeys Sean Coffey
            shadowbug Shadow Bug
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: