<html> <head> <base href="https://bugs.freedesktop.org/" /> </head> <body> <div> <a class="bz_bug_link bz_status_ASSIGNED " title="ASSIGNED - Use correct SASL service name" href="https://bugs.freedesktop.org/show_bug.cgi?id=92918#c8">Comment # 8</a> on <a class="bz_bug_link bz_status_ASSIGNED " title="ASSIGNED - Use correct SASL service name" href="https://bugs.freedesktop.org/show_bug.cgi?id=92918">bug 92918</a> from <a class="email" href="mailto:mkasik@redhat.com" title="Marek Kasik <mkasik@redhat.com>"> Marek Kasik</a> <pre>(In reply to Christophe Fergeau from <a href="show_bug.cgi?id=92918#c7">comment #7</a>) > When QEMU is used, the server ends up using /etc/sasl2/qemu.conf because > QEMU is calling > spice_server_set_sasl_appname(spice_server, "qemu"); > which will cause spice-server to call > sasl_server_init(NULL, "qemu"); > rather than the default > sasl_server_init(NULL, "spice"); > > I'm not sure what SASL does with the service name passed to > sasl_{server,client}_new() though. This one is always "spice" both > server-side and client-side. > > <a href="http://www.sendmail.org/~ca/email/cyrus2/programming.html#sasl_server_new">http://www.sendmail.org/~ca/email/cyrus2/programming.html#sasl_server_new</a> > indicates that « [The name of the service] is used by Kerberos mechanisms > and possibly other mechanisms. It is also used for PAM authentication », but > I don't know exactly how. If it uses this to locate configuration files, > strace -e open should tell us. Thank you for pointing me there. SASL creates the path to the configuration file from the "appname" passed to it which is "qemu" when running qemu (see <a href="https://cgit.cyrus.foundation/cyrus-sasl/tree/lib/server.c#n653">https://cgit.cyrus.foundation/cyrus-sasl/tree/lib/server.c#n653</a>). stracing qemu shows that it really opened the /etc/sasl2/qemu.conf instead of the /etc/sasl2/spice.conf so it could not find the correct keytab file. Not allowing the application to initialize the "appname" makes the authentication working. (I'm not sure why the libvirt worked for me before - probably the same keytab...) So what is the right way to make this work? Should we disable usage of the appname passed by "spice_server_set_sasl_appname()" in spice server or don't set it in qemu?</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the assignee for the bug.</li> </ul> </body> </html>