Commit f2b579ce authored by Jim Garlick's avatar Jim Garlick

gssapi: use GSS_C_BOTH to acquire credentials

Problem: if client sets the ZMQ_GSSAPI_PRINCIPAL to a valid
principal, authentication fails.

When an application sets ZMQ_GSSAPI_PRINCIPAL, whether as a
client or a server, libzmq internally calls gss_acquire_cred()
with cred_usage=GSS_C_ACCEPT.  This cred_usage setting is for
acceptors (servers) only, thus it doesn't work for initiators
(clients).

Solution: Change the cred_usage parameter to GSS_C_BOTH to allow
initiators to set ZMQ_GSSAPI_PRINCIPAL.
parent c371824b
......@@ -338,7 +338,7 @@ int zmq::gssapi_mechanism_base_t::acquire_credentials (char * service_name_, gss
return -1;
maj_stat = gss_acquire_cred (&min_stat, server_name, 0,
GSS_C_NO_OID_SET, GSS_C_ACCEPT,
GSS_C_NO_OID_SET, GSS_C_BOTH,
cred_, NULL, NULL);
if (maj_stat != GSS_S_COMPLETE)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment