GSSAPI unavailable, missing library

[Berge Schwebs Bjørlo]

Firefox is built with support for GSSAPI (and thus Kerberos), but is missing at least one library to work properly. firefox started with NSPR_LOG_FILE and NSPR_LOG_MODULES=all:5 reports the following upon entering a page that uses negotiate-gss:

-1220086080[80931d8]: entering nsAuthGSSAPI::nsAuthGSSAPI()
-1220086080[80931d8]: Fail to load gssapi library

The file missing is apparantly /usr/lib/libgssapi.so, available in heimdal-dev. A workaround is to install the package heimdal-dev. NSPR_LOG will thus report:

-1220245824[80931d8]: entering nsAuthGSSAPI::nsAuthGSSAPI()
-1220245824[80931d8]: Loaded library libgssapi.so (load lib)

IMHO, /usr/lib/libgssapi.so should be distributed with the firefox package, or firefox should depend on heimdal-dev (but it won't make too much sense to require development libraries for regular run-time usage).

[Ian Jackson (ijackson)]

Berge Schwebs Bjørlo writes ("[Bug 41076] GSSAPI unavailable, missing library"):
> The file missing is apparantly /usr/lib/libgssapi.so, available in
> heimdal-dev. A workaround is to install the package heimdal-dev.

I don't think it's wrong that you have to install a Kerberos package
for Kerberos to be supported, surely ? If there is a bug it's that
the .so is in the -dev package, I think.

> IMHO, /usr/lib/libgssapi.so should be distributed with the firefox
> package, or firefox should depend on heimdal-dev (but it won't make too
> much sense to require development libraries for regular run-time usage).

firefox works quite fine without heimdal-dev, except for the Kerberos
functionality, so I think the dependency would be wrong.

Ian.

[Berge Schwebs Bjørlo (berge)]

On Mon, Apr 24, 2006 at 11:01:47AM -0000, Ian Jackson wrote:
> Berge Schwebs Bjørlo writes ("[Bug 41076] GSSAPI unavailable, missing library"):
> > The file missing is apparantly /usr/lib/libgssapi.so, available in
> > heimdal-dev. A workaround is to install the package heimdal-dev.
> I don't think it's wrong that you have to install a Kerberos package
> for Kerberos to be supported, surely ? If there is a bug it's that
> the .so is in the -dev package, I think.

That is good point. Perhaps the bug should be filed against heimdal-dev
instead. I'm not quite sure where the .so-file should reside, though.
heimdal-clients, perhaps?

> > IMHO, /usr/lib/libgssapi.so should be distributed with the firefox
> > package, or firefox should depend on heimdal-dev (but it won't make too
> > much sense to require development libraries for regular run-time usage).
> firefox works quite fine without heimdal-dev, except for the Kerberos
> functionality, so I think the dependency would be wrong.

Agreed, it works great without (except for GSSAPI-stuff, obviously). But
still, Kerberos support in the browser would be splendid to have
out-of-the-box. Debian previously did ship Firefox with GSSAPI-support, and
has an open bug on it,
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=344835. Mozilla recognises
it as a bug as well: https://bugzilla.mozilla.org/show_bug.cgi?id=321514

Cheers,
Berge

--
Berge Schwebs Bjørlo
   There's an infinite number of monkeys outside who want to talk to us about
   this new script for Hamlet that they've worked out. --Douglas Adams

[Ian Jackson (ijackson)]

Berge Schwebs Bjørlo writes ("[Bug 41076] Re: [Bug 41076] Re: [Bug 41076] GSSAPI unavailable, missing library"):
> On Mon, Apr 24, 2006 at 11:01:47AM -0000, Ian Jackson wrote:
> > Berge Schwebs Bjørlo writes ("[Bug 41076] GSSAPI unavailable, missing library"):
> > > The file missing is apparantly /usr/lib/libgssapi.so, available in
> > > heimdal-dev. A workaround is to install the package heimdal-dev.
> > I don't think it's wrong that you have to install a Kerberos package
> > for Kerberos to be supported, surely ? If there is a bug it's that
> > the .so is in the -dev package, I think.
>
> That is good point. Perhaps the bug should be filed against heimdal-dev
> instead. I'm not quite sure where the .so-file should reside, though.
> heimdal-clients, perhaps?

I don't have much knowledge of the heimdal packages, but AFAICT
heimdal-clients is a different source package.

libgssapi1-heimdal contains libgssapi.so.1.4.0; isn't libgssapi.so
just a symlink to that ?

> Agreed, it works great without (except for GSSAPI-stuff, obviously). But
> still, Kerberos support in the browser would be splendid to have
> out-of-the-box. Debian previously did ship Firefox with GSSAPI-support, and
> has an open bug on it,
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=344835. Mozilla recognises
> it as a bug as well: https://bugzilla.mozilla.org/show_bug.cgi?id=321514

Urgh, what a mess.

Is the ABI of libgssapi.so stable ? If so then an unversioned name is
fine and should be in the runtime package.

Ian.

[John Vivirito (gnomefreak)]

Is this still and issue for you? We are trying to trying sort out the older Mozilla issues and would like to know if this still happens. Seems to be fixed upstream.

[Alexander Sack (asac)]

Kerberos should be detected at runtime now. So having a recommends or suggest in package description should be fine.

Can someone confirm that kerberos authentication works out-of-the-box if mit or heimdal libs are installed on the system?

[Berge Schwebs Bjørlo (berge)]

Sorry about late answer, but Firefox Kerberos authentication works out-of-the-box on Feisty with heimdal-clients and no heimdal-dev installed on this system.

[Alexander Sack (asac)]

thanks for confirming. Fix Released.