[LU-16249] Kerberos works with krb5i but not with krb5p

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.16.0, Lustre 2.15.2
• Affects Version/s: Lustre 2.16.0, Lustre 2.15.1
• Labels: kerberos sec
• Severity: 3
• Assignee: Sebastien Buisson
• Reporter: Sebastien Buisson

Description

A system has been configured with Kerberos and is able to mount and access the filesystem from authenticated clients with the kerberos flavor set to krb5i. If the flavor type is changed to krb5p then we get messages like:

lustre-test00-messages:Oct 11 08:58:34 lustre-test00 kernel: LustreError: 5215:0:(gss_krb5_mech.c:1518:gss_unwrap_bulk_kerberos()) checksum mismatch
lustre-test00-messages:Oct 11 08:58:34 lustre-test00 kernel: LustreError: 5215:0:(gss_bulk.c:287:gss_cli_ctx_unwrap_bulk()) failed to decrypt bulk read: 60000

Comments

[Gerrit Updater]

"Oleg Drokin <[e-mail]>" merged in patch https://review.whamcloud.com/c/fs/lustre-release/+/48908/
Subject: LU-16249 sec: krb5_decrypt_bulk calls decryption primitive
Project: fs/lustre-release
Branch: b2_15
Current Patch Set:
Commit: 4bd14502297b17930e90fe969ea69f7fdbde6128

[Peter Jones]

Landed for 2.16

[Gerrit Updater]

"Oleg Drokin <[e-mail]>" merged in patch https://review.whamcloud.com/c/fs/lustre-release/+/48907/
Subject: LU-16249 sec: krb5_decrypt_bulk calls decryption primitive
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: aaab50dd889d71b94784a7ae0a39d478216348b7

[Gerrit Updater]

"Sebastien Buisson <[e-mail]>" uploaded a new patch: https://review.whamcloud.com/c/fs/lustre-release/+/48908
Subject: LU-16249 sec: krb5_decrypt_bulk calls decryption primitive
Project: fs/lustre-release
Branch: b2_15
Current Patch Set: 1
Commit: 8ce9cb54dfe08c89bbc6c2e16f411d39f2a55b1c

[Gerrit Updater]

"Sebastien Buisson <[e-mail]>" uploaded a new patch: https://review.whamcloud.com/c/fs/lustre-release/+/48907
Subject: LU-16249 sec: krb5_decrypt_bulk calls decryption primitive
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 851f3915659941db00a0cda58867e68139e5e0d1