7.105. krb5

Bug Fixes

BZ#771687

Older versions of the libsmbclient package incorrectly depended on the krb5_locate_kdc() function, which is no longer supported. Consequently, applications which used older versions of libsmbclient became incompatible after the Kerberos library update. With this update, an explicit conflict with older versions of libsmbclient has been added. As a result, an incompatible combination cannot be installed.

BZ#773496

Previously, when the krb5-auth-dialog application was used and the prompter was left hanging for a long period of time, a large clock skew was mistakenly recorded. This clock drift was applied in the next kinit session. Consequently, the klist function reported an incorrect expiration time. This bug has been fixed, and the spurious time offset no longer occurs in the described scenario.

BZ#834718

Previously, when a list of trusted roots of a PKINIT client included the KDC's certificates, certain KDC implementations omitted such anchors from the list of certificates in the signed data structure. Consequently, the client failed to verify the KDC's signature on the signed data. With this update, a backported fix has been included to allow the client to use its own copies of relevant certificates. As a result, the verification no longer fails in the aforementioned scenario.

BZ#837855

Prior to this update, attempts to use the kinit command with a keytab file often failed when the keytab file did not contain the Advanced Encryption Standard (AES) keys, but the client's libraries and the KDC both supported AES. The strongest supported encryption type (AES) was chosen by default, even though it was not present in keytab. Consequently, a mismatch error occurred. The bug has been fixed, and keytabs containing any of the supported encryption types are now correctly processed.

BZ#838548

Previously, the krb5 package did not handle the timeout variable properly. In certain cases, the timeout variable became a negative number. Consequently, the client entered a loop while checking for responses. With this update, the client logic has been modified and the described error no longer occurs.

BZ#839017

Prior to this update, the passwd utility failed when used by an Identity Management client. Consequently, an error occurred with the following message:

token manipulation error

The bug has been fixed, and the passwd utility now works with Identity Management as expected.

BZ#845125, BZ#846472

Due to a previous update to a locally-applied patch, files created by the libkrb5 library were given correct SELinux labels. However, each flushing of the replay cache caused the file context configuration to be reloaded to ensure that the correct label is applied to the newly-created replacement replay cache file. This resulted in large performance degradation in applications which accept authentication and use replay caches. With this update, the context configuration is only loaded when the context configuration file has been modified and the configuration is now freed only when the library is unloaded or the calling application exits, thus greatly lowering the impact of this problem.