Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8168518

rcache interop with krb5-1.15

    Details

      Description

      Java's DFL-style rcache uses MD5 hash, which is the same as krb5-1.14 and earlier. krb5-1.15 uses SHA256. If the same AP-REQ is sent to krb5-1.15 first (which creates a new rcache entry) and then sent to a Java acceptor, Java cannot find a match in the rcache file and accepts it.

      Precisely, Java sees 2 entries there: 1st with SHA-256, 2nd the bare one. Java compares them to its own calculation and finds out 1) match the bare one 2) does not match the SHA-256 one, it then concludes the AP-REQ is a different one although sent at the same time.

      Two solutions: 1) understand the SHA-256 entry and treat it as a match. 2) discard the SHA-256 entry and treat the bare one as a match.

        Attachments

          Activity

            People

            • Assignee:
              weijun Weijun Wang
              Reporter:
              weijun Weijun Wang
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: