-
Bug
-
Resolution: Done
-
Major
-
7.0.0.ER7
-
None
When the client sends an initial SPNEGO token with Kerberos as preferred mechanism and includes an invalid kerberos token, then client expects to see the WWW-Authenticate HTTP header with SPNEGO response negTokenResp[ negState = reject ].
As stated in SPNEGO specification negstat is required in first reply:
negState ... This field is REQUIRED in the first reply from the target, and is OPTIONAL thereafter. When negState is absent, the actual state should be inferred from the state of the negotiated mechanism context.
- is cloned by
-
ELY-715 SPNEGO: missing negState field in the first reply for defective token
- Resolved
-
ELY-1547 SPNEGO: missing negstat field in the first reply for expired token
- Resolved
- is incorporated by
-
JBEAP-15482 (7.1.z) Upgrade Elytron from 1.1.11.Final to 1.1.12.Final
- Closed
- is related to
-
JBEAP-3709 [EAP 7] Negotiation/UnderTow does not handle the "Continuation Required" situation correctly
- Closed
-
JBEAP-6679 Elytron SPNEGO: missing negstat field in the first reply
- Closed