[HTTPCLIENT-1736] TGT is forwarded to server when using Kerberos authentication

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 4.5.2
• Fix Version/s: 4.5.3
• Component/s: HttpClient (classic)
• Assignee: Oleg Kalnichevski
• Reporter: Karsten Spang
• Created: 12/Apr/16 13:12
• Updated: 06/Jun/16 14:31
• Resolved: 03/Jun/16 19:28

Description

In GGSSchemeBase.generateGSSToken, line 133 in version 4.5.2:

        gssContext.requestCredDeleg(true);

For Kerberos, this means that the client will forward the to TGT to the server. First, I don't see why you would want that, as that is an unnecessary security risk. Second, I have a problem with my SecurityManager (Oracle's in-database Aurora security manager), so I am unable to create a permission for this that works.
I suggest to change this to

        gssContext.requestCredDeleg(false);

There might be situations where a client application would actually want to pass the TGT, but it should be possible to control this.