krb5/krb5 — pull request #108 by greghudson (2014-04-28 21:05:09+00:00)
Title: krb5_rd_req error improvements

The first two commits just add a small error message helper and use it in the GSS mech. They are only related in that I use the helper in the third commit.

I started a thread on krbdev about changing the error codes. I think there's some minor potential for trouble there but it's probably worth it. If it seems like a bad idea, we can go back to returning KRB5KRB_AP_WRONG_PRINC and just work on the extended error messages.

The error messages are designed to be helpful when the ticket server is the canonical name of the principal, at the cost of being slightly misleading when the ticket server is an alias. For instance, "Request principal host/shortname@REALM not found in keytab" could mislead an admin into thinking that host/shortname@REALM must appear in the keytab, when the real problem might be a kvno mismatch (which the code can't determine without knowing what host/shortname is an alias for). If this seems like a bad idea, we could return more reportorial errors like "Cannot decrypt ticket (ticket server ABC kvno N enctype aes256-cts-sha1-96, keytab matching principal host/@)" without trying to help diagnose the actual problem. That would probably require less code.