Kerberos authentication problems due to changes in Apache HTTPClient 4.4.1
TheUltimateDeployer opened this issue · comments
We observed this problem with the Kerberos authentification for some of our Windows production servers.
After setting the loglevel of Overthere to DEBUG we could see
DEBUG WsmanSPNegoScheme: init <servername_with_domain>
But the domain was different to the used fqdn of the server which resulted in the 401 error.
Our workaround was to use the older overthere 5.0.1 version.
It turned out that Overthere switched for release 5.0.2 from httpclient:4.2.1 to version 4.4.1.
In this version the Apache Commons team introduced the new "useCanonicalName" parameter in the org.apache.http.impl.auth.SPNegoScheme class which is by default set to "true".
The result is that there is a DNS query for the hostname which overwrites the configured hostname.
I will create a PR with our solution in the next days.