cURL / Mailing Lists / curl-library / Single Mail


Re: Curl_sasl_build_spn does not do rDNS lookup when forming SPN

From: Isaac Boukris <>
Date: Sun, 18 Oct 2015 12:12:41 +0300


On Sun, Oct 18, 2015 at 3:03 AM, Wenlong Dong <> wrote:
> Hi,
> When Curl forms the service principal given the service name, it simply
> formats the service principal name with "<service_name>/<host_name>" in
> Curl_sasl_build_spn. The "<host_name>" is basically the host name part of
> the URL. So if the host name is an IP address, the SPN would be wrong
> according to the following doc:
>>> In the case of a host, the instance is the fully qualified hostname,
>>> e.g.,
> Because of this, the kerberos ticket generated by KDC is unusable by the
> service. What's worse is that JDK would pass on calling
> GSSContext.acceptSecContext() silently but in fact it could not even get the
> client's principal name. This affects SPNEGO scenario for libcurl.
> Could libcurl perform a reverse DNS lookup to get the fully qualified
> hostname?

I think you might be able to achieve this at the KRB library level
('rdns=true' under 'libdefaults' in 'krb5.conf').

List admin:
Received on 2015-10-18