Export the value of gss_display_status for any GSS error that prevents authentication (401 error)

[alejandro-perez]

Hi,

when the module finds a GSS error, it typically issues error HTTP 401, and the cause of the error is logged using gss_display_status. It might be useful to export this value into an environment variable (such as the GSS_NAME_ATTR_ERR one), in such a way that the Web server might show it to the user.

[frozencemetery]

We would want to be sure none of these messages can leak information about the server. It seems better to log the message on the server-side than display it to the client to me.

[alejandro-perez]

Well, that is true, I might be thinking this too fast. In my case, where we are using mech_eap, authentication can fail for multiple reasons (e.g. invalid credentials, but also if the RADIUS server is down, etc). What about a middle term? I propose to export GSS_ERROR_MAJ and GSS_ERROR_MIN. In the cases where the Web Application knows the mechanism, they can try to interpret this information and show it to the user in a non-intrusive way. E.g. if MAJ=20 and MIN=2, then you need to check your credentials. How does it sound?

[alejandro-perez]

Although,from RFC 2744:
gss_display_status
[...]
Allows an application to obtain a textual representation of a GSS-API
status code, for display to the user or for logging purposes.