search

mwiede / jsch

fork of the popular jsch library
Other
765 stars 144 forks source link

Incorrect Oid for service name in GSSAPI authentication #648

Closed vpinna80 closed 2 months ago

vpinna80 commented 2 months ago

The Oid used to create the service principal name for the target host is incorrect. This causes the incorrect determination of the realm when the host dns name does not match the realm name.

Description: Suppose you have two realms EXAMPLE.COM and COMPANY.COM with a trust estabilished between them, and host named "my.example.com" that belongs to the domain COMPANY.COM, with this krb5.conf:

[libdefault]
default_realm = EXAMPLE.COM

[domain_realm]
my.example.com = COMPANY.COM
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
.company.com = COMPANY.COM
company.com = COMPANY.COM

Currently, the SPN generated is incorrect as host/my.example.com@EXAMPLE.COM, where it should be host/my.example.com@COMPANY.COM instead.