authGSSServerInit looks for wrong entry from keytab
Question: I am attempting to initialize a context for GSSAPI server-side authentication,
using python-kerberos (1.0.90-3.el6). **My problem is that
myserver.localdomain gets converted to myserver - a part of my given principal
gets chopped off somewhere. Why does this happen?**

Example failure:

    
    
    >>> import kerberos
    >>> kerberos.authGSSServerInit("HTTP@myserver.localdomain")
    Traceback (most recent call last):
      File "<stdin>", line 1, in <module>
    kerberos.GSSError: (('Unspecified GSS failure.  Minor code may provide more information', 851968), ('Unknown error', 0))
    >>>
    

With the help of KRB5_TRACE I get the reason:

    
    
    [1257] 1346344556.406343: Retrieving HTTP/myserver@LOCALDOMAIN from WRFILE:/etc/krb5.keytab (vno 0, enctype 0) with result: -1765328203/No key table entry found for HTTP/myserver@LOCALDOMAIN
    

I can not generate the keytab for plain HTTP/myserver@LOCALDOMAIN because it
would force also the users to access the server with such address. I need to
get the function to work with the proper FQDN name. As far as I can see
authGSSServerInit is supposed to work with the FQDN without mutilating it.

I think the python-kerberos method calls the following krb5-libs (1.9-33.el6)
provided functions, the problem might be also in those:

    
    
    maj_stat = gss_import_name(&min_stat, &name_token, GSS_C_NT_HOSTBASED_SERVICE, &state->server_name);
    maj_stat = gss_acquire_cred(&min_stat, state->server_name,GSS_C_INDEFINITE,GSS_C_NO_OID_SET, GSS_C_ACCEPT, &state->server_creds, NULL, NULL);
    

The kerberos is properly configured on this host, and confirmed to work. I can
for instance kinit as user, and perform authentication the tickets. It is just
the authGSSServerInit that fails to function properly.


Answer: Some of the documentation is misleading:

    
    
    def authGSSServerInit(service):
        """
        Initializes a context for GSSAPI server-side authentication with the given service principal.
        authGSSServerClean must be called after this function returns an OK result to dispose of
        the context once all GSSAPI operations are complete.
    
        @param service: a string containing the service principal in the form 'type@fqdn'
            (e.g. 'imap@mail.apple.com').
        @return: a tuple of (result, context) where result is the result code (see above) and
            context is an opaque value that will need to be passed to subsequent functions.
        """
    

In fact the API expects only the type. For instance "HTTP". The rest of the
principal gets generated with the help of resolver(3). Although the rest of
the kerberos stuff is happy using short names the resolver generates FQDN, but
only if dnsdomainname is properly set.

