This morning I upgraded a dovecot installation from 1.1.16 to 1.2.4 on a FreeBSD 7.2 server, and then spent 3 hours trying to figure out why GSSAPI authentication had broken.
It turned out to be a recent change in Dovecot's mech-gssapi.c to do with checking for NULs in usernames: everything worked fine when I disabled that test. http://hg.dovecot.org/dovecot-1.2/rev/5d53b1d66d1b
This is what I was seeing in the log file with auth_debug enabled:
auth(default): client in: AUTH 1 GSSAPI service=imap secured lip=192.0.2.36 rip=192.0.2.168 lport=143 rport=51168
auth(default): gssapi(?,192.0.2.168): Obtaining credentials for imap@mail1.example.com
auth(default): client out: CONT 1
auth(default): client in: CONT<hidden>
auth(default): gssapi(john@EXAMPLE.COM,192.0.2.168): security context state completed.
auth(default): client out: CONT 1 YGwGCSqGSIb3EgECAgIAb10wW6ADAgEFoQMCAQ+iTzBNoAMCARCiRgREIuGJR3fqiMdvWjEg6utI7bt3fZuI8Ulk4LoFu59aMgnX+Kivdohxin2A71UCEC7oG0sVYe7vrTjg2N9s27D1BLRuJbQ=
auth(default): client in: CONT<hidden>
auth(default): gssapi(john@EXAMPLE.COM,192.0.2.168): Negotiated security layer
auth(default): client out: CONT 1 YD8GCSqGSIb3EgECAgIBBAD/////MINNkeu5LVS8fiZNSnb8j8iKBuHArr/sHec++VYV+9SSc+RkAf///wQEBAQ=
auth(default): client in: CONT<hidden>
auth(default): gssapi(john@EXAMPLE.COM,192.0.2.168): authz_name has NULs
auth(default): client out: FAIL 1 user=john@EXAMPLE.COM imap-login: Disconnected (auth failed, 1 attempts): user=john@EXAMPLE.COM, method=GSSAPI, rip=192.0.2.168, lip=192.0.2.36, TLS: Disconnected
I commented out the 'return -1;' at the end of the if(data_has_nuls) block (to preserve the log message but fall through), rebuilt, and everything works again.
auth(default): gssapi(john@EXAMPLE.COM,192.0.2.168): authz_name has NULs auth(default): client out: OK 1 user=john@EXAMPLE.COM
I tried building dovecot 1.2.4 with Heimdal 0.6.3, 1.0.1 and 1.2.1 and all gave the same result. Is it possible that the data_has_nuls test doesn't work as intended or that it only works with MIT Kerberos?
Thank you.
-- John Marshall