binarylogic/authlogic — Issue #300: HTTP_AUTHORIZATION parsing fails under Apache with Kerberos
Author: lavieenrose
Created: 2012-01-27 09:42:07+00:00
State: open

The Apache Kerberos Module writes something like "Negotiate ..." to HTTP_AUTHORIZATION. When the rails Basic Auth mechanism tries to parse that field, it gets binary and passes it on to authlogic which in turn tries to lookup a user with that binary. this fails, of course.

I am not sure where to report this, because in rails you have to turn on basic auth specifically. The argument to report it here would be that I would not try to use basic auth together with kerberos. But authlogic enables it by default so the default configuration does not work out of the box.

I think a solution could be to check if the parsing went well before querying the database with the result.