Summary
-------

Extend the Kerberos configuration file (*krb5.conf*, specified by the *java.security.krb5.conf* system property) to include a 'canonicalize' option under the 'libdefaults' section. Change the Kerberos client default behavior to send the 'canonicalize' bit *off* in all Authentication Service (AS) requests.

Problem
-------

After the implementation of [RFC 6806][1] ([JDK-8215032]), the Kerberos client sends the 'canonicalize' bit *on* by default in all KDC requests (including those used to get TGTs as well as those to get TGSs tickets). As described in the referred RFC, this option bit announces support for Referrals and Name Canonicalization from the client side.

One of the consequences of the previous is that the KDC may issue a TGT ticket -in response to an AS request- with a different Client Name (cname) than the one requested.

Even though the Kerberos client and the JAAS framework  are ready to handle such change, some applications -which get the ticket through undocumented APIs- consider it too disruptive.

In addition, old KDCs such as Windows AD 2008, change the cname when 'canonicalize' is *on* but do not include the security scheme proposed by RFC 6806 in [Section 11][2] to mitigate associated security risks. These responses are then rejected by the client.


Solution
--------

Change the Kerberos client default behavior to send 'canonicalize' bit *off* in all AS requests. Introduce a Kerberos configuration to turn 'canonicalize' *on* for AS requests. These changes will bring better alignment with the [MIT's Kerberos client][3].

Note: the 'sun.security.krb5.disableReferrals' system and security properties can be used to turn Name Canonicalization *off*. However, that also implies that TGS referrals -when requesting TGS tickets- will be disabled too. The proposed solution allows to disabled Name Canonicalization only, while continue supporting RFC 6806 TGS referrals.


Specification
-------------

1) The Kerberos client sends 'canonicalize' bit *off* in all AS requests by default. The previous behavior is not modified for TGS requests, which continue including the 'canonicalize' bit *on* by default and a fallback scheme in case the server returns an unexpected error.

2) A new 'canonicalize' option in the Kerberos configuration file (*krb5.conf*, specified by the *java.security.krb5.conf* system property) is introduced under the 'libdefaults' section. The default value is *false*. If the 'canonicalize' option is set *true*, all AS requests will contain the 'canonicalize' bit *on* (unless referrals were disabled through *sun.security.krb5.disableReferrals*).

Grammar for 'canonicalize' option in the Kerberos configuration file:

    canonicalize = true|false

Example of a *krb5.conf* file with 'canonicalize' *on*:

    [libdefaults]
    ...
    canonicalize = true
    ...

Specs that need to be updated:

 * 7 Java Generic Security Services (Java GSS-API)
   * The Kerberos 5 GSS-API Mechanism
     * Supported krb5.conf Settings
         * Add 'canonicalize' in '[libdefaults]' section, above 'renewable' (so we group request options together)
         * Add 'canonicalize = false' in defaults for the *krb5.conf* file parameters, above 'renewable = false' (for the previous reason).

Review discussion thread and further information [here][4].


  [1]: https://tools.ietf.org/html/rfc6806
  [2]: https://tools.ietf.org/html/rfc6806#section-11
  [3]: https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html#libdefaults
  [4]: https://mail.openjdk.java.net/pipermail/security-dev/2020-March/021494.html