How to chisel libgssapi-krb5-2?

[nhart12]

I'm not sure if this is the correct place for this. I'm attempting to use kerberos in a dotnet 8 image to connect to sql server.. this currently works in a regular aspnet jammy 8 image, however when chiseling out libgssapi-krb5-2 in a chiseled-extra image I receive an error:

System.Data.SqlClient.SqlException: Cannot authenticate using Kerberos. Ensure Kerberos has been initialized on the client with 'kinit' and a Service Principal Name has been registered for the SQL Server to allow Kerberos authentication.
ErrorCode=InternalError, Exception=Interop+NetSecurityNative+GssApiException: GSSAPI operation failed with error - An invalid status code was supplied (Server not found in Kerberos database).
....

My gut is telling me there is a missing dependency when chiseleing out the gss and krb5 libs. When comparing with the regular ASP net images one big glaring difference is all the dependencies are installed to /usr/lib and /lib is symlinked to /usr/lib..
With chisel since there is no usrmerge library's are in a mix of both folders and I'm wondering if one of the native libraries is looking in the wrong place. Has anyone gotten this working?

[richlander]

docker run --rm -it mcr.microsoft.com/dotnet/sdk:8.0-jammy apt list | grep krb
libgssapi-krb5-2/now 1.19.2-2ubuntu0.3 arm64 [installed,local]
libkrb5-3/now 1.19.2-2ubuntu0.3 arm64 [installed,local]
libkrb5support0/now 1.19.2-2ubuntu0.3 arm64 [installed,local]

Those are the libraries that are helping you.

This is the pattern for adding packages with chiseled: rockcrafters/dotnet#21

Related: #4751

[nhart12]

in my case i'm mounting an external /etc/krb5.conf

[nhart12]

Circling back to this, I tried slicing all of those things together with no luck... I also ran lsof -p ${pid} | grep x86_64-linux-gnu on my running dotnet service in a full aspnet container and found a whole bunch of .so files referenced that don't exist in the chiseled image that I'm going to play around with to see what is actually needed with time permitting at some point.

[richlander]

Not helpful, but I have to think that Server not found in Kerberos database is an important part of the error message.

In any case, I've asked for help. Let's see if I can get someone else to take a look. This is well outside of my knowledge.

[roji]

/cc @David-Engel, can you help us figure out what's going on here?

[David-Engel]

Digging out under an email backlog and just noticed this.

Server not found in Kerberos database tells me that maybe the SPN generated by SqlClient isn't the same as the one the server has registered. Unfortunately, you can't control that in System.Data.SqlClient. System.Data.SqlClient also doesn't have good logging (maybe not any logging) on Linux. If you can switch to Microsoft.Data.SqlClient, you can enable logging using xperf, which will show you what SPN is being used. Recent versions also now offer a ServerSPN connection option to specify it yourself in case you are in an environment where it just doesn't generate nicely.