Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 738968

Summary: www-apache/mod_auth_kerb-5.4-r2 references krb5_rc_resolve_full, but it is removed from
Product: Gentoo Linux Reporter: Barnabás Virágh <cyborgyn>
Component: Current packagesAssignee: No maintainer - Look at if you want to take care of it <maintainer-needed>
Severity: major CC: joakim.tjernlund, jstein, sam
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
See Also:
Package list:
Runtime testing required: ---
Bug Depends on: 830208    
Bug Blocks:    
Attachments: mit-krb5-1.18.2 fix
Fixes SEGV
mod_auth_kerb-5.4-r4 ebuild , EAPI=6

Description Barnabás Virágh 2020-08-25 15:52:25 UTC
app-crypt/mit-krb5-1.18.2-r1 doesn't contain anymore krb5_rc_resolve_full, thus apache with mod_auth_kerb enabled fails to start:
apache2            | * apache2 has detected an error in your setup:
apache2            |apache2: Syntax error on line 166 of /etc/apache2/httpd.conf: Syntax error on line 2 of /etc/apache2/modules.d/11_mod_auth_kerb.conf: Cannot load modules/ into server: /usr/lib64/apache2/modules/ undefned symbol: krb5_rc_resolve_full
apache2            | * ERROR: apache2 failed to start

Reproducible: Always

Steps to Reproduce:
1. Build apache
2. Build mod_auth_kerb
3. Configure apache to use mod_auth_kerb
4. Start apache
Actual Results: references krb5_rc_resolve_full, even though it is removed from Thus apache fails to start.

Expected Results: doesn't use nonexistent API krb5_rc_resolve_full, Apache can load the mod_auth_kerb module, and can successfully start, and authenticates users through kerberos SSO.
Comment 1 Barnabás Virágh 2020-08-25 15:54:15 UTC
It is somewhat related to this bug: (the method is removed in the same commit)
Comment 2 Barnabás Virágh 2020-08-30 13:19:04 UTC
since this packages is on EAPI=5, and "epatch_user" is missing, was a bit harder to test patchs, but I found a working one here:

Applying this, the Kerberos authentication works again.
Comment 3 David Heidelberg (okias) 2020-08-31 15:14:45 UTC
Confirmed... anyway, any official solution, PullRequest or something available?
Comment 4 Joakim Tjernlund 2020-09-15 17:16:56 UTC
Created attachment 660420 [details, diff]
mit-krb5-1.18.2 fix

Works for me.
RCACHE is mandatory these days so hardcode
Comment 5 Joakim Tjernlund 2020-09-15 17:18:14 UTC
(In reply to Barnabás Virágh from comment #2)
> since this packages is on EAPI=5, and "epatch_user" is missing, was a bit
> harder to test patchs, but I found a working one here:
> attachment/krb5-1.18.patch
> Applying this, the Kerberos authentication works again.

That was my first hack, attached a better one.
Works with 1.17 too
Comment 6 Joakim Tjernlund 2020-09-15 17:19:51 UTC
Created attachment 660423 [details, diff]
Fixes SEGV

You should apply this one too
Comment 7 Joakim Tjernlund 2020-09-15 17:28:16 UTC
Created attachment 660426 [details]
mod_auth_kerb-5.4-r4 ebuild , EAPI=6

Our internal ebuild

Got one for mod_auth_gssapi too, not tested though
Comment 8 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-12-29 08:41:44 UTC
Fix here: Stabilisation in progress.