search

stnoonan / spnego-http-auth-nginx-module

SPNEGO HTTP Authentication Module for nginx
Other
275 stars 112 forks source link

Off-by-one error causes mutual authentication to fail #86

Closed hawicz closed 5 years ago

hawicz commented 5 years ago

The calculation of the spnego token length at https://github.com/stnoonan/spnego-http-auth-nginx-module/blob/master/ngx_http_auth_spnego_module.c#L867 incorrectly uses one less byte than the output token returned from the earlier gss_accept_sec_context() call. This causes mutual authentication to fail because the client won't receive the full set of token bytes. It should drop the "- 1" and just do "spnego_token.len = output_token.length".

jhnbyrn commented 5 years ago

You are right. I had the same issue - I recompiled with the fix you described and it works now.