Skip Menu |

This queue is for tickets about the LWP-Authen-Negotiate CPAN distribution.

Report information
The Basics
Id: 128699
Status: new
Priority: 0/
Queue: LWP-Authen-Negotiate

Owner: Nobody in particular
Requestors: ppisar [...]

Bug Information
Severity: (no value)
Broken in: 0.08
Fixed in: (no value)


Subject: Add LWP_AUTHEN_NEGOTIATE_MUTUAL environment variable
Download (untitled) / with headers
text/plain 257b
I encountered a web server that requires GSS_C_MUTUAL_FLAG flag on the client side and enabling ticket delegation is an overkill. Attached patch adds LWP_AUTHEN_NEGOTIATE_MUTUAL environment variable to allow users enabling the GSS_C_MUTUAL_FLAG GSSAPI flag.
Subject: LWP-Authen-Negotiate-0.08-Add-LWP_AUTHEN_NEGOTIATE_MUTUAL-environment-variable.patch
From 1fbee954127c942001975071da0d3229c118b25c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <> Date: Mon, 4 Mar 2019 15:42:43 +0100 Subject: [PATCH] Add LWP_AUTHEN_NEGOTIATE_MUTUAL environment variable MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Some HTTP servers (e.g. Red Hat SSO) require GSS_C_MUTUAL_FLAG GSSAPI flag on the client side although they do not send any ticket back in an HTTP Negotiate header. A work around is enablging LWP_AUTHEN_NEGOTIATE_DELEGATE, but this potentially hazardous as it allows the server to impersonate the client. Therofre this patch adds LWP_AUTHEN_NEGOTIATE_MUTUAL environment variable to allow users to to enable the GSS_C_MUTUAL_FLAG flag without delegatation. One could be tempted to enable the flag by default because all the entities are usually equiped with a Kerberos ticket, but for the sake of a compatibility let not do it. Signed-off-by: Petr Písař <> --- lib/LWP/Authen/ | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/lib/LWP/Authen/ b/lib/LWP/Authen/ index 3dce7b1..ac24f02 100644 --- a/lib/LWP/Authen/ +++ b/lib/LWP/Authen/ @@ -83,6 +83,9 @@ sub authenticate | GSS_C_MUTUAL_FLAG | GSS_C_DELEG_FLAG; } + if ( $ENV{LWP_AUTHEN_NEGOTIATE_MUTUAL} ) { + $iflags = $iflags | GSS_C_MUTUAL_FLAG; + } my $bindings = GSS_C_NO_CHANNEL_BINDINGS; my $creds = GSS_C_NO_CREDENTIAL; my $itime = 0; @@ -197,6 +200,10 @@ Run kinit first ;-) Define to enable ticket forwarding to webserver. +=item LWP_AUTHEN_NEGOTIATE_MUTUAL + +Define to enable a mutual authentication with the webserver. + =back =head1 SEE ALSO -- 2.20.1

This service is sponsored and maintained by Best Practical Solutions and runs on infrastructure.

Please report any issues with to