{"action":"created","issue":{"url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/69","repository_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi","labels_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/69/labels{/name}","comments_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/69/comments","events_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/69/events","html_url":"https://github.com/modauthgssapi/mod_auth_gssapi/issues/69","id":133386929,"number":69,"title":"GssapiUseS4U2Proxy fails when falling back to Basic auth","user":{"login":"amessina","id":1409187,"avatar_url":"https://avatars.githubusercontent.com/u/1409187?v=3","gravatar_id":"","url":"https://api.github.com/users/amessina","html_url":"https://github.com/amessina","followers_url":"https://api.github.com/users/amessina/followers","following_url":"https://api.github.com/users/amessina/following{/other_user}","gists_url":"https://api.github.com/users/amessina/gists{/gist_id}","starred_url":"https://api.github.com/users/amessina/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amessina/subscriptions","organizations_url":"https://api.github.com/users/amessina/orgs","repos_url":"https://api.github.com/users/amessina/repos","events_url":"https://api.github.com/users/amessina/events{/privacy}","received_events_url":"https://api.github.com/users/amessina/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2016-02-13T02:11:20Z","updated_at":"2016-02-14T18:59:34Z","closed_at":null,"body":"Using the following config atop the master branch @3361a7910e5b934d65ca3cb70aa551dddff69179 with the patch applied from https://github.com/modauthgssapi/mod_auth_gssapi/pull/65, the use of Delegated credentials fails.  After the failure, I do see krb5ccache_HTTP and user@REALM ccaches in /run/httpd/clientcaches, and it seems like the user@REALM ccache isn't in place \"fast enough\" to be used (in this case a PHP application using ```putenv(\"KRB5CCNAME={$_SERVER['KRB5CCNAME']}\");``` connecting to PostgreSQL).  The error I receive is ```GSSAPI continuation error: No credentials cache found```  Delegated credentials work perfectly in this situation when *not* falling back to Basic auth (when the browser client already has creds).\r\n\r\n```\r\nGssapiSSLonly On\r\nGssapiBasicAuth On\r\nGssapiAllowedMech krb5\r\n\r\nGssapiUseS4U2Proxy On\r\nGssapiCredStore keytab:/etc/httpd/conf/HTTP.keytab\r\nGssapiCredStore client_keytab:/etc/httpd/conf/HTTP.keytab\r\n# The following must be writable by the apache user\r\nGssapiCredStore ccache:FILE:/run/httpd/clientcaches/krb5ccache_HTTP\r\nGssapiDelegCcacheDir /run/httpd/clientcaches\r\n\r\nGssapiUseSessions On\r\nSession On\r\nSessionEnv On\r\nSessionCookieName gssapi_session path=/example;domain=example.com;httponly;secure;\r\n```\r\n\r\nAnother strange thing happens in the above scenario...  I get the following SELinux AVC:\r\n```\r\nSELinux is preventing /usr/sbin/httpd from read access on the key Unknown.\r\n\r\n*****  Plugin catchall (100. confidence) suggests   **************************\r\n\r\nIf you believe that httpd should be allowed read access on the Unknown key by default.\r\nThen you should report this as a bug.\r\nYou can generate a local policy module to allow this access.\r\nDo\r\nallow this access for now by executing:\r\n# grep httpd /var/log/audit/audit.log | audit2allow -M mypol\r\n# semodule -i mypol.pp\r\n\r\nAdditional Information:\r\nSource Context                system_u:system_r:httpd_t:s0\r\nTarget Context                system_u:system_r:gssd_t:s0\r\nTarget Objects                Unknown [ key ]\r\nSource                        httpd\r\nSource Path                   /usr/sbin/httpd\r\nPort                          <Unknown>\r\nHost                          host.example.com\r\nSource RPM Packages           httpd-2.4.18-1.fc23.x86_64\r\nTarget RPM Packages           \r\nPolicy RPM                    selinux-policy-3.13.1-158.4.fc23.noarch\r\nSelinux Enabled               True\r\nPolicy Type                   targeted\r\nEnforcing Mode                Permissive\r\nHost Name                     host.example.com\r\nPlatform                      Linux host.example.com 4.3.5-300.fc23.x86_64\r\n                              #1 SMP Mon Feb 1 03:18:41 UTC 2016 x86_64 x86_64\r\nAlert Count                   20\r\nFirst Seen                    2016-02-12 19:28:12 CST\r\nLast Seen                     2016-02-12 19:58:27 CST\r\nLocal ID                      9377811c-f5ac-4605-9642-8f00b2e3ea78\r\n\r\nRaw Audit Messages\r\ntype=AVC msg=audit(1455328707.588:7791): avc:  denied  { read } for  pid=6026 comm=\"httpd\" scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:system_r:gssd_t:s0 tclass=key permissive=1\r\n\r\n\r\ntype=SYSCALL msg=audit(1455328707.588:7791): arch=x86_64 syscall=keyctl success=yes exit=ECHILD a0=b a1=1d86e34c a2=0 a3=0 items=0 ppid=3799 pid=6026 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)\r\n\r\nHash: httpd,httpd_t,gssd_t,key,read\r\n```"},"comment":{"url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/comments/183950051","html_url":"https://github.com/modauthgssapi/mod_auth_gssapi/issues/69#issuecomment-183950051","issue_url":"https://api.github.com/repos/modauthgssapi/mod_auth_gssapi/issues/69","id":183950051,"user":{"login":"frenche","id":7945916,"avatar_url":"https://avatars.githubusercontent.com/u/7945916?v=3","gravatar_id":"","url":"https://api.github.com/users/frenche","html_url":"https://github.com/frenche","followers_url":"https://api.github.com/users/frenche/followers","following_url":"https://api.github.com/users/frenche/following{/other_user}","gists_url":"https://api.github.com/users/frenche/gists{/gist_id}","starred_url":"https://api.github.com/users/frenche/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/frenche/subscriptions","organizations_url":"https://api.github.com/users/frenche/orgs","repos_url":"https://api.github.com/users/frenche/repos","events_url":"https://api.github.com/users/frenche/events{/privacy}","received_events_url":"https://api.github.com/users/frenche/received_events","type":"User","site_admin":false},"created_at":"2016-02-14T18:59:34Z","updated_at":"2016-02-14T18:59:34Z","body":"I see, so PHP PDO doesn't like both kind of credentials...\r\nI'm running out of ideas :( \r\n\r\nPerhaps you could try isolate the problem by testing the PHP script directly from CLI after exporting KRB5CCNAME to point to the delegated credentials (made by MAG) and also compare with credentials delegated by 'kinit -c CCACHE user@REALM' command."}}