fix: yaml decode bug

Processor would skip non-JSON files, this fixes and improves regex

Codecov Report
All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 42.08%. Comparing base (b4db945) to head (d53b19d).
Report is 13 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #131      +/-   ##
==========================================
- Coverage   43.20%   42.08%   -1.13%
==========================================
  Files          16       28      +12
  Lines        1178     1421     +243
==========================================
+ Hits          509      598      +89
- Misses        570      715     +145
- Partials       99      108       +9

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.


keep_metric_names is missing in StreamAggrRule

According to docs:
https://docs.victoriametrics.com/stream-aggregation/#output-metric-names
https://docs.victoriametrics.com/stream-aggregation/#stream-aggregation-config
there is keep_metric_names option to keep original metric name after the aggregation.
But operator (v0.43.2) doesn't support it, checked vmagent crd - no such field.

Changes included to the v0.44.0 release


switch custom target JSON test to a less exotic target

We used to test an AVR target here, but while it is nice to test a 16bit target, it is also currently the case that rustc CI does not even check that libcore builds on a 16bit target -- and we don't want Miri to be in the game of maintaining that support. (See https://github.com/rust-lang/rust/issues/130818.)
So let's use a tier 2 target as the basis for testing a custom JSON target.
(FWIW, we also test wasm32-wasip2 which is tier 3, but I expect it will become tier 2 Soon-ish.)

@bors r+

:pushpin: Commit 1ded45c02c4dd7bb5683b763f49d89232bc55769 has been approved by RalfJung
It is now in the queue for this repository.

:hourglass: Testing commit 1ded45c02c4dd7bb5683b763f49d89232bc55769 with merge 9efab211d308a85a0afa6af229b08c786bf84477...

:sunny: Test successful - checks-actions
Approved by: RalfJung
Pushing 9efab211d308a85a0afa6af229b08c786bf84477 to master...


Fix crash in MS.Internal.Commands.CommandHelpers.CriticalExecuteCommandSource

Version: <IP_ADDRESS> | axocover
Reason
System.Exception: This is a test exception!
Link to HockeyApp

https://rink.hockeyapp.net/manage/apps/465309/crash_reasons/155414478

Testing telemetry.


Restructure the metadata (sample parameters)

Simplify the metadata table with only three main data types.
class MetaDataColumn<T> for (String, Double, Date)

// column -> raw file -> value
Map<MetaDataColumn<T>, Map<RawDataFile, T/Object>>

// or raw file -> column -> value
Map<RawDataFile, Map<MetaDataColumn<T>, T/Object>>

[ ] three data types: String, double, Date
[ ] replace the data structure in MZmineProject (everything with UserParameter)
[ ] use the dialog to add new columns and set values in the TableView
[ ] Import/Export to csv / tsv (tab-separated) (header, types, values)

I've started working on this issue

@InspiritedCoder i would like to help you out tell me how can I get started

@InspiritedCoder i would like to help you out tell me how can I get started

@Tarush-Singh35 Thank you for your willingness to help. As far as I understand, it is necessary to implement some "generalized" class through which we will perform basic operations with the project metadata (parameters) table. If you want, we can discuss a possible solution as soon as I come up with one. :)

Its good if you propose a structure and create a PR once you are ready to show.
Then we can discuss more together. @Tarush-Singh35, best way would be to then review the code and we can improve it together.


EOFError (bad content body) when uploading a file

When using Paperclip to upload a file, the file upload instantly fails, logging "EOFError (bad content body):"
The exact same operation works with Webrick

So, should this be resolved by now @mitio @josh? I am still getting this issue, with an upload-form-heavy app, and it makes pow completely unusable. I see 1.3.2 is still the latest version but this pull request (and all the others by mitio) have been rejected because it should be fixed in the next version, correct?
Should I install pow from github if I want to get this working?

@JeanMertz, as I understand it, the idea is to refactor the code so that the custom pause(stream) function is never used, which should resolve the issue. In the meantime, you can use my version of the project as a temporary solution (until a new official pow version is released or until it is fixed in the master branch here).
If I'm not mistaken, you can git clone my repo somewhere, then cd to that folder, run npm install and cake start and it should boot pow from that folder.

+1 i have the same problem (rails 3.1, pow 0.3.2, carrierwave 0.5.7)

+1

Hey, guys, thanks to @janko-m I remembered one important thing — you need to use my rewrite-pause-stream branch, so:
git clone git://github.com/mitio/pow.git && cd pow && git checkout rewrite-pause-stream

Then follow the instructions @janko-m has provided. I had to set this up long ago and I don't remember what exactly I needed to install back then. However, I do have cake start/cake stop tasks (at least in my rewrite-pause-stream branch).

It worked. The npm install didn't work before because I got spaces in the path. I really shouldn't do that ever again :P. So, I have cake start now.
But, unfortunately, I still get this "EOFError (bad content body)". I get it with Sinatra and plain upload form. I only get it when I try to upload a file the second time. So, if I uploaded a file one time in the past, then erased it in the meanwhile, it is as Pow has somehow memorized that file, and it throws this error after I try to upload it again.

@janko-m, are you sure you're using the pow with my patch?  If you run cake stop in the cloned repo, your site should stop working if you're using the correct pow version.

I'm having this problem with Rails 3.1.1 and Pow 0.3.2.  Every file upload fails.

Same here..
rails 3.1.0
0.3.2 every upload

+1
Rails 3.1.1
Pow 0.3.2

+1

+1 :)

+1 - for me it seems to be with files over 1mb.
Rails 3.1.3
Pow 0.4.0 pre
Rack 1.3.6

+1
Rails 3.2.1
Rack 1.4.1
Pow 06094c6
Also noticing that when the upload fails that I'm seeing a "WARNING: Can't verify CSRF token authenticity" in the log - and Devise [2.0.4] is logging me out. Looks like the request parsing is blowing up.
Work-around by using very small files or using thin/webrick

+1
Rails 3.1.1
Rack 1.4.0
Pow 0.3.2
for files over 1mb in size


Modlog: Use connection.send for sending popup

This makes it clearer here that there is more popup elements than just |popup|

This was tested thoroughly this time :p


refactor(write-stream): refactor to remove redundant code

Both _insertScript and _insertStyle shared the majority of code
Fixes #183

Coverage decreased (-0.1%) to 89.324% when pulling bb33c6bf3474c3feb5951aa46b2cddd8d89a4dce on issue-183 into 55d39df57bbd8a3a75c4591bdb30d479faa30ad5 on master.


DOC: plot_stc

This PR hopefully helps clarify the return value of plot_stc as described in https://github.com/mne-tools/mne-python/issues/8850#issuecomment-776180591.
Closes #8850

Looks good:
https://25084-1301584-gh.circle-artifacts.com/0/dev/generated/mne.viz.plot_source_estimates.html?highlight=plot_source_estimates#mne.viz.plot_source_estimates

Thanks @GuillaumeFavelier


Support jest 23.x.x

There's a new jest release: https://github.com/facebook/jest/releases/tag/v23.0.0
It broke flow compatibility: https://travis-ci.org/wemake-services/wemake-vue-template/builds/383500926
It also introduces new features: test.each and friends.
Related: https://github.com/facebook/jest/pull/6102

This is because there's no v23 of Jest in the flow-typed libdef. Feel free to create one.

@AndersDJohnson I'd like to take this if no one does.

Merged: https://github.com/flowtype/flow-typed/commit/bf845eee3a386f36c001bdec0e585339298822c7
Related: https://github.com/flowtype/flow-typed/pull/2347/files#diff-8604ef767e3d48b617e6af750db6b59f
Thanks everyone!

That doesn't seem to include test.each and friends.

Yes, that true.


Metadata hash is always part of bytecode

Component
Forge
Have you ensured that all of these are up to date?

[X] Foundry
[X] Foundryup

What version of Foundry are you on?
forge 0.2.0 (09d53c2 2022-03-31T00:36:36.371915+00:00)
What command(s) is the bug in?
forge build
Operating System
macOS (amd)
Describe the bug
We found that deploying with CREATE2 gives us different addresses between environments. We tracked this down to the ast key in the artifacts. The devs in the support forum said that the metadata hash is included as part of the bytecode and is currently not configurable. We would like the ability to turn off the metadata appending to the bytecode.
Reference config by Uniswap to allow determinism: https://github.com/Uniswap/v3-core/blob/ed88be38ab2032d82bf10ac6f8d03aa631889d48/hardhat.config.ts#L57-L62

todo

[ ] add a metadata_hash Config value
[ ] populate the metadata field in solc Settings in Config

Additional notes on things that may cause non-deterministic output:
Before version 0.8.6 omitting the 'enabled' key was not equivalent to setting it to false and would actually disable all the optimizations.

@see: {@link https://docs.soliditylang.org/en/latest/using-the-compiler.html#compiler-input-and-output-json-description}

The option for bytecodeHash was introduced in 0.6.0

@see: {@link https://docs.soliditylang.org/en/v0.6.0/using-the-compiler.html}

Etherscan solc config
///
solidity: {
    version: '0.8.10',
    settings: {
      metadata: {
        bytecodeHash: 'none',
      },
      optimizer: {
        enabled: true,
        runs: 200,
        details: {
          yul: false,
        },
      },
      outputSelection: {
        '*': {
          '*': [
            'abi',
            'evm.bytecode',
            'evm.deployedBytecode',
            'evm.methodIdentifiers',
            'metadata',
          ],
          '': ['ast'],
        },
      },
    },
  },

Configuration to use for Sourcify  verification
/** @note Compiler output configuration for verifying on Sourcify */
export const defaultSolcOutputSelection = {
  '*': {
    '*': [
      'abi',
      'evm.bytecode',
      'evm.deployedBytecode',
      'evm.methodIdentifiers',
      'metadata',
    ],
    '': ['ast'],
  },
};

see https://www.npmjs.com/package/@ethereum-sourcify/verification


feat: Port the headers escaping feature

Motivation:
Porting the headers escaping feature, see https://github.com/netty/netty/pull/12585.
Modifications:
Add escaping to stomp encoder/decoder according specification.
Result:
Stomp codec comply with STOMP 1.2 and in most case backward compatible with 1.1 and 1.0.

@chrisvest PTAL


Create iterable differs for every option that support collections

This resolves #53

Is this commit supposed to fix the issue in the dx-data-grid where the updates to the dataSource are not being fed into the grid without a .refresh(); ? If that was one of the pieces of functionality which was supposed to be resolved by this commit, then it seems as though it did not quite work. Otherwise, would it be possible to let me know whether you intend to restore this functionality without the requirement for the refresh?


Error when attempting to download files

Hi all.
I am able to log in to my icloud account and enumerate domains perfectly with inflatabledonkey.
But when I begin the download I get the follwing error:
13:58:44.462 [main] ←[31mWARN ←[0;39m c.g.h.i.util.NSDictionaries - -- parseNSObject() - failed to parse data: The given data is not a property list of a supported format. 0x0a0c45787472612d427435617479122a417070446f6d61696e47726f75702d67726f75702e636f6d2e66616365626f6f6b2e46616365626f6f6b18f9c7def50120fac7def50128fac7def50130bdde1638f50340f503488083025000674415bf62c210c457e8ff25a3ba9be710c000000010146c528000000030100000100000048b05fad171eb5f6fc4c6964c9fe96d92d5a19415c6f2c34767763d6e3c92d786ff483cbed3680c1a81b224cf0531bd73e23e59d32289594de6a37144d74f4f691775dc274bde8710f000000000005b000
13:58:44.462 [ForkJoinPool.commonPool-worker-6] ←[31mWARN ←[0;39m c.g.h.i.util.NSDictionaries - -- parseNSObject() - failed to parse data: The given data is not a property list of a supported format. 0x0a464c6962726172792f4c6f67732f77686174736170702d323031372d30352d30312d31382d32352d35322d3934382d57686174734170702d333339322d6c61756e63682e6c6f67121f417070446f6d61696e2d6e65742e77686174736170702e576861747341707018a2cedef50120a5cfdef50128a5cfdef50130bdf40338f50340f50348a483025000
Can anyone help?

Unfortunately I am not so experienced in this, but I can tell you that this is caused by a server-side update Apple made. Currently both iPhone Backup Extractor and EPPB do not even work at the moment

@imnotthemessiah Hi there. This sounds suspiciously like #54 which was patched a while back. Can you confirm that you've downloaded the latest build and still experience the error?

No further input. Suspected duplicate of #54. Closing ticket.


Menu's do not show on secondary monitor

When I click the 'File', 'Edit', etc menu items when atom is opened on a secondary screen, the menu items do not show up. I have to drag atom to my primary monitor to see the menu items expand. Depending on the location of atom on the secondary scree, you can see the menu items appear in the top right hand screen of my primary monitor (attached screenshot)

This looks like a duplicate of https://github.com/atom/atom/issues/3415 – please subscribe there for updates.


iOS TypeError: undefined is not an object (evaluating 'sjcl.random')

RN 0.39.2, node 7.x, using Remote Debugger, TypeError: undefined is not an object (evaluating 'sjcl.random') when running synchronous randomBytes call. When running it asynchronous, the output is null from the async call, though it does return the async call.
Found out that the Safari remote debugger does not work, due to the "error getting entropy from browser". But that it DOES work on the device. Maybe put this in the readme or output a more friendly error message to browser console.

I get this error on Android.

@bjackson have you installed and linked react-native-randombytes?

Same error here on Android. react-native-randombytes installed and linked

Having the same issue on Android when trying to run, followed instructions, react-native-randombytes linked, etc.... any ideas?

I have the same problem. It seems to go away if i enable remote js debugging

are you guys using rn-nodeify ?

I am using rn-nodeify, on android, and including import './shim.js'; at the top of my index.android.js, as per the README, as well. Oddly, it still seems that I get moderately random data, though.

Same issues here, in android platfrom.

does this sample project work for you guys? https://github.com/mvayngrib/rnctest

@mvayngrib Thx for your reply, this project works fine (in android), but its react-native version is not latest.

works fine for me on both ios and android with RN 0.42
https://github.com/mvayngrib/rnctest/tree/0.42

@mvayngrib unfortunately this rnctest app isn't working for me on android. The log I got in react-native log-android was:
I/ReactNativeJS(18705): There was an error collecting entropy from the browser:
I/ReactNativeJS(18705): { [TypeError: undefined is not an object (evaluating 'sjcl.random')]
I/ReactNativeJS(18705):   line: 12548,
I/ReactNativeJS(18705):   column: 28,
I/ReactNativeJS(18705):   sourceURL: 'http://localhost:8081/index.android.bundle?platform=android&dev=true&hot=false&minify=false' }
E/ReactNativeJS(18705): undefined is not an object (evaluating 'crypto.pbkdf2Sync.toString')
E/ReactNativeJS(18705): Module AppRegistry is not a registered callable module (calling runApplication)

I'm not exactly sure what android version I'm running, or the specific hardware, but I can try to find out. Thank you anyway for trying to tie this library together.

@athanclark good catch, fixed in 2.0.2 (locked down pbkdf2 to 3.0.8)

@mvayngrib hmm, it's still not working for me - I updated the package.json for rnctest to react-native-crypto: ^2.0.2, but I'm still getting the same error :\ I'm going to keep tinkering

@athanclark did you make sure the pbkdf2 you have in node_modules is version 3.0.8? npm install and yarn f up sometimes too

and don't forget to re-run: rn-nodeify --hack after you install anything

Wow holy Toledo you are right! It's working like a charm now. Thank you!!

@athanclark awesome, have fun :)


Add Multiple Tables

In this milestone, I implemented the following:

Created a table named "owners".
Created a table named "species".
Modified the animals table.
Inserted given data into the owners and species' tables.
Used primary key & foreign key mechanisms to Join tables.
Queried multiple tables.
Prepared complex queries that answer analytical questions given in the project requirements.

Queries Screenshots

Hello @BenMukebo 👋🏼 ,
Thank you for the effort and time you dedicated to reviewing and approving this PR. The optional changes which you pointed out have been swiftly implemented. You are awesome 💯


fix: ts error when using the tsr utility on createNextHandler

Hello, thanks for the awesome release that adds support to Next App Router.
Everything works great but what I would like to achieve is to have multiple routers and merge them together as I instantiate the handler. I have noticed that the serverless package does not have any docs yet and that the linked example was very bare.
Basically what I'm trying to achieve is something like this:
The sample contract
import { initContract } from '@ts-rest/core';
import { z } from 'zod';

const c = initContract();

export const contract = c.router({
  hello: {
    greet: {
      method: 'GET',
      path: '/hello/greet',
      description: 'Say hello',
      responses: {
        200: z.object({
          message: z.string(),
        }),
      },
    },
  },
});

Then I wanted to define a separate router under the hello namespace using the tsr utility I have found in the source code. It was exported, but I could not find any usage to it, so I assumed it's a utility function for us the end users. Correct me if I'm wrong
import { tsr } from '@ts-rest/serverless/next';
import { contract } from './contract';

export const helloRouter = tsr.router(testContract.hello, {
  greet: async () => {
    return { status: 200, body: { message: 'Hi' } };
  },
});

I then get a TypeScript Error router when trying to put the helloRouter under my handler on my route handler definition saying that my helloRouter cannot be assigned to the expected router shape of the createNextHandler function.
// app/api/[...ts-rest]/route.ts

import { createNextHandler } from '@ts-rest/serverless/next';

const handler = createNextHandler(contract, {
   hello: helloRouter // ❗TypeScript error here
}, {
    basePath: '/api',
    jsonQuery: true,
    responseValidation: true,
    handlerType: 'app-router',

})

Note: This only occurs when strict is set to true in tsconfig.json

Thank you!


Fix typo in README

gratious => gratuitous.
I made an assumption as to what you meant. You may have also meant "gracious" but I've no clue :slightly_smiling_face:

Hehe! I actually meant "gracious". Would you mind making the change in your pull request?
Thank you so much!


fix: a forked process random extends parent's random state

add random.seed() before the forked worker to run in daemon.py
here is a test code:
from random import random
from operator import add
def funcx(x):
  print x[0],x[1]
  return 1 if x[0]**2 + x[1]**2 < 1 else 0
def genRnd(ind):
  x=random() * 2 - 1
  y=random() * 2 - 1
  return (x,y)
def runsp(total):
  ret=sc.parallelize(xrange(total),1).map(genRnd).map(funcx).reduce(lambda x, y: x + y)/float(total) * 4
  print ret
runsp(3)

once i start the pyspark-shell, no matter how many times i run "runsp(N)"  aafter, this code always print out
0.896083541418 -0.635625854075
-0.0423532645466 -0.526910255885
0.498518696049 -0.872983895832
1.3333333333333333
>>> sc.parallelize(xrange(total),1).map(genRnd).map(funcx).reduce(add)/float(total) * 4
0.896083541418 -0.635625854075
-0.0423532645466 -0.526910255885
0.498518696049 -0.872983895832
1.3333333333333333
>>> sc.parallelize(xrange(total),1).map(genRnd).map(funcx).reduce(add)/float(total) * 4
0.896083541418 -0.635625854075
-0.0423532645466 -0.526910255885
0.498518696049 -0.872983895832
1.3333333333333333

i think this is because when we import  pyspark.worker in the daemon.py, we alse import a random by the shuffle.py which is imported by  pyspark.worker, this worker, forked by "pid = os.fork()", also remains the state of the parent's random, thus every forked worker get the same random.next().
we need to re-random the random by random.seed, which will solve the problem, but i think this PR. may not be the proper fix.
ths.

Can one of the admins verify this patch?

Hi @ThomasLau, It would be nicer if the contribution follows https://cwiki.apache.org/confluence/display/SPARK/Contributing+to+Spark.

@HyukjinKwon sorry  for that. i just report this bug to the jire SPARK-15611.
and many many thanks for your advice!


Add client kerberos support

This PR give users the possibility to authenticate, with login and password, via MIT/Heimdal Kerberos rather than NTLM. If Kerberos credentials can't be acquired we fall back on NTLM.
Note also that currently, the server side for Kerberos have not been implemented yet. Work to do.

@freerdp-bot can you test that ?

Hi @dodo040, very nice contribution (despite the build trouble with @freerdp-bot ).
I've played with it this weekend and I haven't managed to connect via Kerberos, it's always going back to NTLM. I feel like Kerberos authentication works but it fails when retrieving the TGS. Is there any special setup to do ?

Hi, maybe you could try first to get TGT and TGS to check if your Kerberos setup is ok.
`$ kinit dodo040
<EMAIL_ADDRESS>Password:
$ klist
Credentials cache: FILE:/tmp/krb5cc_1000
Principal<EMAIL_ADDRESS>Issued                Expires               Principal
May 15 11:03:08 2017  May 15 21:03:08 2017<EMAIL_ADDRESS>$ kvno TERMSRV/remotedesktop.example.com
<EMAIL_ADDRESS>kvno = 22
$ klist
Credentials cache: FILE:/tmp/krb5cc_1000
Principal<EMAIL_ADDRESS>Issued                Expires               Principal
May 15 11:03:08 2017  May 15 21:03:08 2017<EMAIL_ADDRESS>May 15 11:04:19 2017  May 15 21:03:08 2017<EMAIL_ADDRESS>`

@dodo040 ok so it seems that you can connect only when using the name and not the ip. So here the negociation goes further, but it ends with :
[11:48:45:725] [8622:8623] [ERROR][com.freerdp.core.nla] - SPNEGO failed with NTSTATUS: 0xC000009A

I can provide the full log if needed

@hardening yes please the full log would be helpful.

Ok so it's here => https://gist.github.com/hardening/85afe97b3ab409d691cf335094492da2
Running through valgrind with DEBUG_NLA and WITH_MEMCHECK enabled
the TGS seemed to be acquired correctly:
# klist
....
15/05/2017 19:47:28  16/05/2017 05:47:23<EMAIL_ADDRESS>	renew until 16/05/2017 19:47:22

in my setup the DC is a samba4 host if it matters.

Can you show me the cmake you used and the errors you get while compiling without kerberos support ?

I've found a problem (might be the same as yours) which was already there and comes from cups lib which links to kerberos libraries.
Compiled on master branch with kerberos libs present in filesystem :
$ cmake -DWITH_CUPS=ON .
$ make
$ ldd client/X11/xfreerdp | grep kr
libgssapi_krb5.so.2 => /usr/local/lib/libgssapi_krb5.so.2 (0x00007f27adf35000)
libkrb5.so.3 => /usr/local/lib/libkrb5.so.3 (0x00007f27aa498000)
libkrb5support.so.0 => /usr/local/lib/libkrb5support.so.0 (0x00007f27a9e55000)
I think we should activate WITH_GSSAPI flag when WITH_CUPS is ON.

@dodo040 Actually no, that is not the problem. Have a look at the console output of the pull request tester. It fails at compiling, not linking.

Started by upstream project "PullRequestTester" build number 2088
originally caused by:
GitHub pull request #3954 of commit 7684a5c8e920e3f26e87c090c5790007f7bd500f, no merge conflicts.
[EnvInject] - Loading node environment variables.
Building remotely on ubuntu-1404 (clang linux) in workspace /home/jenkins/workspace/linux

git rev-parse --is-inside-work-tree # timeout=10
Fetching changes from the remote Git repository
git config remote.origin.url https://github.com/FreeRDP/FreeRDP.git # timeout=10
Fetching upstream changes from https://github.com/FreeRDP/FreeRDP.git
git --version # timeout=10
git fetch --tags --progress https://github.com/FreeRDP/FreeRDP.git +refs/pull/:refs/remotes/origin/pr/
git rev-parse refs/remotes/origin/pr/3954/merge^{commit} # timeout=10
git rev-parse refs/remotes/origin/origin/pr/3954/merge^{commit} # timeout=10
JENKINS-19022: warning: possible memory leak due to Git plugin usage; see: https://wiki.jenkins-ci.org/display/JENKINS/Remove+Git+Plugin+BuildsByBranch+BuildData
Checking out Revision 9a2588afabe1a42e4d6f66778591aadd9bab709e (refs/remotes/origin/pr/3954/merge)
git config core.sparsecheckout # timeout=10
git checkout -f 9a2588afabe1a42e4d6f66778591aadd9bab709e
First time build. Skipping changelog.
Triggering linux ? ubuntu
Triggering linux ? ubuntu32
linux ? ubuntu completed with result FAILURE
linux ? ubuntu32 completed with result FAILURE
Started calculate disk usage of build
Finished Calculation of disk usage of build in 0 seconds
Started calculate disk usage of workspace
Finished Calculation of disk usage of workspace in 0 seconds
Finished: FAILURE

@akallabeth How do you know with the console output it fails at compiling ?

@dodo040 Have a look here: https://ci.freerdp.com/job/linux/2129/label=ubuntu32/console

@dodo040 u are totaly right, it fails on linking! Will tell @akallabeth if he is in office again.

@akallabeth @MartinHaimberger could you give a try with kerberos authentication, I guess that at thincast you have a correctly configured DC and hosts joined to it ?

The relevant entry is '''CMakeFiles/freerdp.dir/core/transport.c.o: In function `transport_krb5_check_account' ''' this function may not be used when build without kerberos support. the build slaves do not have it enabled (yet) but it should compile nonetheless. don't know why the warning about unefined functions is not in this build and only the following linker error.

The build activate the '--no-undefined' flag. Should compile now with the fix.

@freerdp-bot test

@hardening according to your tickets it seems you are well authenticated against Kerberos. But there is something strange. In your gist file, logs are dated to [16:53:58] while the TGS is only valid after [19:47:28].
Are the client and server clocks well synchronized ?
A wireshark capture would be helpful too.

@freerdp-bot test

Removing WITH_KRB5 renders the code introduced with #3791 (#3417) (mainly in libfreerdp/core/transport.c) unusable.

I modified the code accordingly to support the flag WITH_GSSAPI in transport.c.

@dodo040 ahh, nice might have overlooked this then. Sorry.
Would you be so kind and give me a brief overview of your test setup and how one can test the PR?

@bmiklautz my setup consists of a KDC which is an Active Directory Windows 2012 R2, and a PC with Kerberos 5 release 1.15 (MIT) installed on it.
Here is the minimal krb5.conf file I used :
[libdefaults]
        default_realm = EXAMPLE.COM

[realms]
        EXAMPLE.COM = {
                kdc = XXX.XXX.XXX.XXX
                admin_server = XXX.XXX.XXX.XXX
                master_kdc = XXX.XXX.XXX.XXX
                default_domain = example.com
    }

[domain_realm]
        .example.com = EXAMPLE.COM
        example.com = EXAMPLE.COM

To start xfreerdp to connect via Kerberos to a remote session, type the command :
$ ./xfreerdp /v:remotehost.example.com /u:dodo040 /p:"password"
Once connected to your remote session you should have on your PC the following tickets :
$ klist
Credentials cache: FILE:/tmp/krb5cc_1000
        Principal: dodo040\<EMAIL_ADDRESS>
  Issued                Expires               Principal
Jun  9 13:27:31 2017  Jun  9 23:27:31 2017<EMAIL_ADDRESS>Jun  9 13:27:31 2017  Jun  9 23:27:31 2017<EMAIL_ADDRESS>
Tell me if you need more infos.

@akallabeth @hardening Anyone to start a @freerdp-bot test ?

@freerdp-bot  can you test that ?

@freerdp-bot can you test that for real ?

@hardening can you restart a test just before the last commit ?

@freerdp-bot  can you test that ?
For the posix things to stay in the winpr spirit I would have done the opposite (typedef ssize_t SSIZE_T) and used SSIZE_T. I'm not a windows guru but I don't see the point of using if defined(_WIN64) (isn't ifdef _WIN32 enough for windows ?)

The if defined(_WIN64) is useless as _WIN32 already includes these platforms. From MSDN:

_WIN32 Defined as 1 when the compilation target is 32-bit ARM, 64-bit ARM, x86, or x64. Otherwise, undefined.
_WIN64 Defined as 1 when the compilation target is 64-bit ARM or x64. Otherwise, undefined.

Also I agree to rather use the WinPR type (SSIZE_T) than the posix type (ssize_t) - use of ssize_t could cause some trouble i.e. with VS2010 because it's incorrectly defined: https://stackoverflow.com/questions/22265610/why-ssize-t-in-visual-studio-2010-is-defined-as-unsigned).

@freerdp-bot test

@freerdp-bot test again please.

First of sorry for the long delay. I did some more testing today.
On debian jessie with mit kerberos. kinit works fine locally (against a samba 4 domain). The test machine is joined the domain. Not sure if it should work at all with samba having any kerberos realm used/configured isn't an uncommon case.
First test:

No credentials (klist shows nothing), connecting to the test host (could reproduce this with any host) as described below and type an invalid password. Tried with and without domain set:

xfreerdp /v:testhost /u:user [/d:domain]

results in a segfault.
#1  0x00007ffff58df641 in _int_free (av=0x7fffe8000020, p=<optimized out>, have_lock=0) at malloc.c:4057
#2  0x00007ffff23445f2 in krb5_free_data () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#3  0x00007ffff233dfd3 in krb5_init_creds_free () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#4  0x00007ffff5c983c4 in acquire_cred () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#5  0x00007ffff5c98bc4 in init_creds () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#6  0x00007ffff5c98f17 in kerberos_InitializeSecurityContextA () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#7  0x00007ffff5c99c41 in negotiate_InitializeSecurityContextA () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#8  0x00007ffff5c9d778 in winpr_InitializeSecurityContextA () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#9  0x00007ffff6481baa in nla_client_begin () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#10 0x00007ffff64c5ec8 in transport_connect_nla () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#11 0x00007ffff6485f41 in nego_security_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#12 0x00007ffff6488706 in nego_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#13 0x00007ffff64b45c5 in rdp_client_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#14 0x00007ffff64a8c8a in freerdp_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#15 0x000000000041b190 in xf_client_thread ()
#16 0x00007ffff5c8e2e6 in thread_launcher () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#17 0x00007ffff7bc7064 in start_thread (arg=0x7fffecbfa700) at pthread_create.c:309
#18 0x00007ffff594e62d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

Second test:
Same setup as for the first test but this time with a valid grating ticket (user@REALM). Connecting to the test host as above causes the following problem:
[12:58:16:377] [3238:3242] [ERROR][com.winpr.sspi.Kerberos] - error while getting credentials
Program received signal SIGSEGV, Segmentation fault.

#0  malloc_consolidate (av=av@entry=0x7fffe8000020) at malloc.c:4151
#1  0x00007ffff58df641 in _int_free (av=0x7fffe8000020, p=<optimized out>, have_lock=0) at malloc.c:4057
#2  0x00007ffff23445f2 in krb5_free_data () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#3  0x00007ffff233dfd3 in krb5_init_creds_free () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#4  0x00007ffff5c983c4 in acquire_cred () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#5  0x00007ffff5c98bc4 in init_creds () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#6  0x00007ffff5c98f17 in kerberos_InitializeSecurityContextA () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#7  0x00007ffff5c99c41 in negotiate_InitializeSecurityContextA () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#8  0x00007ffff5c9d778 in winpr_InitializeSecurityContextA () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#9  0x00007ffff6481baa in nla_client_begin () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#10 0x00007ffff64c5ec8 in transport_connect_nla () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#11 0x00007ffff6485f41 in nego_security_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#12 0x00007ffff6488706 in nego_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#13 0x00007ffff64b45c5 in rdp_client_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#14 0x00007ffff64a8c8a in freerdp_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#15 0x000000000041b190 in xf_client_thread ()
#16 0x00007ffff5c8e2e6 in thread_launcher () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#17 0x00007ffff7bc7064 in start_thread (arg=0x7fffecbfa700) at pthread_create.c:309
#18 0x00007ffff594e62d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

The tgt is gone after xfreerdp was run..
Third test
Like the first one (no ticket(s)) but this time a valid password was entered when prompted:
Password:

Program received signal SIGSEGV, Segmentation fault.

#0  malloc_consolidate (av=av@entry=0x7fffe8000020) at malloc.c:4151
#1  0x00007ffff58df641 in _int_free (av=0x7fffe8000020, p=<optimized out>, have_lock=0) at malloc.c:4057
#2  0x00007ffff234497f in krb5_free_cred_contents () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#3  0x00007ffff233df88 in krb5_init_creds_free () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#4  0x00007ffff5c983c4 in acquire_cred () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#5  0x00007ffff5c98bc4 in init_creds () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#6  0x00007ffff5c98f17 in kerberos_InitializeSecurityContextA () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#7  0x00007ffff5c99c41 in negotiate_InitializeSecurityContextA () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#8  0x00007ffff5c9d778 in winpr_InitializeSecurityContextA () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#9  0x00007ffff6481baa in nla_client_begin () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#10 0x00007ffff64c5ec8 in transport_connect_nla () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#11 0x00007ffff6485f41 in nego_security_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#12 0x00007ffff6488706 in nego_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#13 0x00007ffff64b45c5 in rdp_client_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#14 0x00007ffff64a8c8a in freerdp_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#15 0x000000000041b190 in xf_client_thread ()
#16 0x00007ffff5c8e2e6 in thread_launcher () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#17 0x00007ffff7bc7064 in start_thread (arg=0x7fffecbfa700) at pthread_create.c:309
#18 0x00007ffff594e62d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

Fourth test
Valid granting ticket, valid password (with or without domain)
[13:17:00:885] [8719:8723] [INFO][com.winpr.sspi.Kerberos] - Authenticated to Kerberos v5 via login/password
*** Error in `freerdp/build-gssapi/client/X11/xfreerdp': corrupted double-linked list: 0x00007fffe8036650 ***

#1  0x00007ffff589c448 in __GI_abort () at abort.c:89
#2  0x00007ffff58d91b4 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7ffff59ce210 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff58de98e in malloc_printerr (action=1, str=0x7ffff59ca2ec "corrupted double-linked list", ptr=<optimized out>) at malloc.c:4996
#4  0x00007ffff58dec4c in malloc_consolidate (av=av@entry=0x7fffe8000020) at malloc.c:4165
#5  0x00007ffff58dfe98 in _int_malloc (av=0x7fffe8000020, bytes=2048) at malloc.c:3423
#6  0x00007ffff58e2020 in __GI___libc_malloc (bytes=2048) at malloc.c:2891
#7  0x00007ffff23704c3 in ?? () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#8  0x00007ffff2370ce6 in ?? () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#9  0x00007ffff236f5a4 in ?? () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#10 0x00007ffff236f6b3 in ?? () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#11 0x00007ffff236fec8 in ?? () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#12 0x00007ffff2372cc9 in ?? () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#13 0x00007ffff236711b in k5_os_init_context () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#14 0x00007ffff2343730 in krb5_init_context_profile () from /usr/lib/x86_64-linux-gnu/libkrb5.so.3
#15 0x00007ffff25f2fd0 in ?? () from /usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2
#16 0x00007ffff25dfaa2 in ?? () from /usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2
#17 0x00007ffff25e0e18 in gss_init_sec_context () from /usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2
#18 0x00007ffff5c9f833 in sspi_gss_init_sec_context () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#19 0x00007ffff5c98f88 in kerberos_InitializeSecurityContextA () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#20 0x00007ffff5c99c41 in negotiate_InitializeSecurityContextA () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#21 0x00007ffff5c9d778 in winpr_InitializeSecurityContextA () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#22 0x00007ffff6481baa in nla_client_begin () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#23 0x00007ffff64c5ec8 in transport_connect_nla () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#24 0x00007ffff6485f41 in nego_security_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#25 0x00007ffff6488706 in nego_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#26 0x00007ffff64b45c5 in rdp_client_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#27 0x00007ffff64a8c8a in freerdp_connect () from /home/test/freerdp/build-gssapi/libfreerdp/libfreerdp2.so.2
#28 0x000000000041b190 in xf_client_thread ()
#29 0x00007ffff5c8e2e6 in thread_launcher () from /home/test/freerdp/build-gssapi/winpr/libwinpr/libwinpr2.so.2
#30 0x00007ffff7bc7064 in start_thread (arg=0x7fffecbfa700) at pthread_create.c:309
#31 0x00007ffff594e62d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

I couldn't reproduce the crashes on each run but they happened quite frequently.
Also it looks like that the granting ticket is newly initialized if xfreerdp is run - or do you renew it if there is a valid one?
I'll try to get a windows based setup as well for testing.

Hello,

Not sure if it should work at all with samba having any kerberos realm used/configured isn't an uncommon case.

Do you mean that you don't set any KDC (Samba or standalone) in your installation ? For sure it will not work with any Kerberos realm configured because you need to set UPN (user@REALM) and SPN (TERMSRV/remote@REALM) in KDC database.
I'm trying to set up a working environment for using Samba too. Not over yet. I'll be able to give you more information once done.

I couldn't reproduce the crashes on each run but they happened quite frequently.

Have you ever succeed to connect to the remote host while well authenticated against Kerberos or never have you ? Or it is just a segfault that is happening sometimes ? If only sometimes, can you show me the logs when no segfault occurs ?

Also it looks like that the granting ticket is newly initialized if xfreerdp is run - or do you renew it if there is a valid one?

Basically xfreerdp acquires new tickets (TGT and TGS) if they are no longer valid or not yet created. Note that if a TGT is present and valid, only the TGS is created.
About your tests, there should be any differences using domain or not because we use the Kerberos realm. Thus, no need to inform domain field to authenticate with Kerberos.
Giving a wrong password without any tickets should cause a fallback on NTLM and trigger an alert access denied at the end due to wrong credentials, like this :
$ ./xfreerdp /u:user /v:remotehost /p:"wrongpassword"
[14:06:58:260] [20441:20442] [ERROR][com.winpr.sspi.Kerberos] - error while getting credentials
[14:06:58:260] [20441:20442] [ERROR][com.winpr.sspi.Kerberos] - Kerberos credentials not found and could not be acquired
[14:06:58:260] [20441:20442] [WARN][com.winpr.negotiate] - No Kerberos credentials. Retry with NTLM
[14:06:58:260] [20441:20442] [WARN][com.winpr.sspi] - InitializeSecurityContextA status SEC_E_NO_CREDENTIALS [0x8009030E]
[14:06:58:261] [20441:20442] [INFO][com.winpr.sspi.NTLM] - VERSION ={
[14:06:58:261] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	ProductMajorVersion: 6
[14:06:58:261] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	ProductMinorVersion: 1
[14:06:58:261] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	ProductBuild: 7601
[14:06:58:261] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	Reserved: 0x000000
[14:06:58:261] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	NTLMRevisionCurrent: 0x0F
[14:06:58:262] [20441:20442] [INFO][com.winpr.sspi.NTLM] - negotiateFlags "0xE2898235"
[14:06:58:262] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	NTLMSSP_NEGOTIATE_56 (0),
[14:06:58:262] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	NTLMSSP_NEGOTIATE_KEY_EXCH (1),
[14:06:58:262] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	NTLMSSP_NEGOTIATE_128 (2),
[14:06:58:262] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	NTLMSSP_NEGOTIATE_VERSION (6),
[14:06:58:262] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	NTLMSSP_NEGOTIATE_TARGET_INFO (8),
[14:06:58:262] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	NTLMSSP_NEGOTIATE_EXTENDED_SESSION_SECURITY (12),
[14:06:58:262] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	NTLMSSP_TARGET_TYPE_DOMAIN (15),
[14:06:58:262] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	NTLMSSP_NEGOTIATE_ALWAYS_SIGN (16),
[14:06:58:262] [20441:20442] [INFO][com.winpr.sspi.NTLM] - 	NTLMSSP_NEGOTIATE_NTLM (22),
[...]
[14:06:59:375] [20441:20442] [ERROR][com.freerdp.core] - freerdp_set_last_error ERRCONNECT_AUTHENTICATION_FAILED [0x00020009]
[14:06:59:375] [20441:20442] [ERROR][com.freerdp.core.transport] - BIO_read returned an error: error:14094419:SSL routines:SSL3_READ_BYTES:tlsv1 alert access denied
[14:06:59:375] [20441:20442] [ERROR][com.freerdp.client.x11] - Freerdp connect error exit status 1

Then, not a common case, but giving a wrong password with a valid TGT at start should cause, after TGS was acquired properly, Windows remote host to start a prompt, to give user a second chance to enter the correct password to connect to the session.
To debug segfault I will need more than these logs. Maybe you can activate DEBUG log-level and WITH_DEBUG_NLA and do an export KRB5_TRACE=/dev/stdout to have more info on what Kerberos is doing.

@bmiklautz I guess a valgrind run should clearly show the error...

Have you ever succeed to connect to the remote host while well authenticated against Kerberos or never have you ? Or it is just a segfault that is happening sometimes ? If only sometimes, can you show me the logs when no segfault occurs ?

Yes I could connect to the remote host.
What I figured was that the segfaults happens if you use the IP address of an host that doesn't have an reverse DNS entry. Or try to connect to a host that isn't in the domain.
The segfault doesn't happen every time but quite frequently (something like  every second or third time). All logs were attached. No more messages (even with debug level set to TRACE).

Basically xfreerdp acquires new tickets (TGT and TGS) if they are no longer valid or not yet created. > Note that if a TGT is present and valid, only the TGS is created.

What I've seen is that the tgt is renewed (or re-created) when xfreerdp is run. - I ran kinit and got a tgt after running xfreerdp the 'valid starting' when klist is run was different. Which isn't a big problem but it seems the tgt gets cleaned/removed in some cases:

get a tgt with kinit
connect to any host that is not in the domain (IP or DNS name that is not joined the domain but connectable with RDP)
if the connection was successful the TGT is gone

Giving a wrong password without any tickets should cause a fallback on NTLM and trigger an alert
access denied at the end due to wrong credentials, like this :
That works as you describe. If the password is incorrect, fallback to NTLM.

[~/freerdp/build-gssapi] 2s % KRB5_TRACE=/dev/stdout  WLOG_LEVEL=TRACE ./client/X11/xfreerdp /v:192.168.xx.xx /u:user
[10:19:13:309] [21766:21766] [DEBUG][com.freerdp.utils] - Registering signal hook...
[10:19:13:314] [21766:21766] [DEBUG][com.freerdp.client.common.cmdline] - windows: 0/1 posix: -1000/0 compat: 1/0
[10:19:13:315] [21766:21767] [DEBUG][com.freerdp.client.x11] - Searching for XInput pointer device
[10:19:13:315] [21766:21767] [DEBUG][com.freerdp.client.x11] - Pointer device: 10
[10:19:13:316] [21766:21767] [DEBUG][com.freerdp.core.nego] - Enabling security layer negotiation: TRUE
[10:19:13:316] [21766:21767] [DEBUG][com.freerdp.core.nego] - Enabling restricted admin mode: FALSE
[10:19:13:316] [21766:21767] [DEBUG][com.freerdp.core.nego] - Enabling RDP security: TRUE
[10:19:13:316] [21766:21767] [DEBUG][com.freerdp.core.nego] - Enabling TLS security: TRUE
[10:19:13:316] [21766:21767] [DEBUG][com.freerdp.core.nego] - Enabling NLA security: TRUE
[10:19:13:316] [21766:21767] [DEBUG][com.freerdp.core.nego] - Enabling NLA extended security: FALSE
[10:19:13:316] [21766:21767] [DEBUG][com.freerdp.core.nego] - state: NEGO_STATE_NLA
[10:19:13:316] [21766:21767] [DEBUG][com.freerdp.core.nego] - Attempting NLA security
[10:19:13:316] [21766:21767] [DEBUG][com.freerdp.core.nego] - RequestedProtocols: 3
[10:19:13:333] [21766:21767] [DEBUG][com.freerdp.core.nego] - RDP_NEG_RSP
[10:19:13:333] [21766:21767] [DEBUG][com.freerdp.core.nego] - selected_protocol: 2
[10:19:13:333] [21766:21767] [DEBUG][com.freerdp.core.nego] - state: NEGO_STATE_FINAL
[10:19:13:333] [21766:21767] [DEBUG][com.freerdp.core.nego] - Negotiated NLA security
[10:19:13:333] [21766:21767] [DEBUG][com.freerdp.core.nego] - nego_security_connect with PROTOCOL_NLA
[10:19:13:340] [21766:21767] [DEBUG][com.winpr.utils] - Could not open SAM file!
Password:
[10:19:15:712] [21766:21767] [DEBUG][com.winpr.sspi] - InitSecurityInterfaceExA
[10:19:15:712] [21766:21767] [DEBUG][com.freerdp.core.nla] - nla_client_init 314 : packageName=Kerberos ; cbMaxToken=48000
[10:19:15:712] [21766:21767] [DEBUG][com.winpr.sspi.gss] - gss_import_name: SEC_E_OK (0x00000000)
[21766]<PHONE_NUMBER>.864309: Convert service TERMSRV (service with host as instance) on host 192.168.xx.xx to principal
[21766]<PHONE_NUMBER>.864337: Remote host after forward canonicalization: 192.168.xx.xx
[21766]<PHONE_NUMBER>.865146: Remote host after reverse DNS processing: 192.168.xx.xx
[21766]<PHONE_NUMBER>.865191: Got service principal TERMSRV/192.168.xx.xx@
[21766]<PHONE_NUMBER>.865734: ccselect can't find appropriate cache for server principal TERMSRV/192.168.xx.xx@
[21766]<PHONE_NUMBER>.865843: Getting credentials<EMAIL_ADDRESS>-> TERMSRV/192.168.xx.xx@ using ccache FILE:/tmp/krb5cc_1000
[21766]<PHONE_NUMBER>.865964: Retrieving<EMAIL_ADDRESS>-> TERMSRV/192.168.xx.xx@ from FILE:/tmp/krb5cc_1000 with result: -1765328243/Matching credential not found
[21766]<PHONE_NUMBER>.866016: Retrying<EMAIL_ADDRESS>-><EMAIL_ADDRESS>with result: -1765328243/Matching credential not found
[21766]<PHONE_NUMBER>.866027: Server has referral realm; starting with<EMAIL_ADDRESS>[21766]<PHONE_NUMBER>.866080: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: 0/Success
[21766]<PHONE_NUMBER>.866093: Starting with TGT for client realm<EMAIL_ADDRESS>-><EMAIL_ADDRESS>[21766]<PHONE_NUMBER>.866102: Requesting tickets for<EMAIL_ADDRESS>referrals on
[21766]<PHONE_NUMBER>.866153: Generated subkey for TGS request: rc4-hmac/2E0C
[21766]<PHONE_NUMBER>.866218: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[21766]<PHONE_NUMBER>.866324: Encoding request body and padata into FAST request
[21766]<PHONE_NUMBER>.866415: Sending request (1633 bytes) to TEST.LOCAL
[21766]<PHONE_NUMBER>.866466: Resolving hostname samba01.TEST.LOCAL
[21766]<PHONE_NUMBER>.866866: Initiating TCP connection to stream 192.168.xx.yy:88
[21766]<PHONE_NUMBER>.867178: Sending TCP request to stream 192.168.xx.yy:88
[21766]<PHONE_NUMBER>.870314: Received answer (107 bytes) from stream 192.168.xx.yy:88
[21766]<PHONE_NUMBER>.870361: Response was from master KDC
[21766]<PHONE_NUMBER>.870387: TGS request result: -1765328377/Server not found in Kerberos database
[21766]<PHONE_NUMBER>.870451: Requesting tickets for<EMAIL_ADDRESS>referrals off
[21766]<PHONE_NUMBER>.870477: Generated subkey for TGS request: rc4-hmac/3AC9
[21766]<PHONE_NUMBER>.870498: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[21766]<PHONE_NUMBER>.870555: Encoding request body and padata into FAST request
[21766]<PHONE_NUMBER>.870629: Sending request (1633 bytes) to TEST.LOCAL
[21766]<PHONE_NUMBER>.870649: Resolving hostname samba01.TEST.LOCAL
[21766]<PHONE_NUMBER>.870995: Initiating TCP connection to stream 192.168.xx.yy:88
[21766]<PHONE_NUMBER>.871258: Sending TCP request to stream 192.168.xx.yy:88
[21766]<PHONE_NUMBER>.873282: Received answer (107 bytes) from stream 192.168.xx.yy:88
[21766]<PHONE_NUMBER>.873327: Response was from master KDC
[21766]<PHONE_NUMBER>.873346: TGS request result: -1765328377/Server not found in Kerberos database
[10:19:15:722] [21766:21767] [DEBUG][com.winpr.sspi.gss] - gss_init_sec_context: SEC_E_UNKNOWN (0x000D0000)
[21766]<PHONE_NUMBER>.873913: Initializing FILE:/tmp/krb5cc_1000 with default princ<EMAIL_ADDRESS>[21766]<PHONE_NUMBER>.874081: Getting initial credentials for<EMAIL_ADDRESS>[21766]<PHONE_NUMBER>.874190: Sending request (173 bytes) to TEST.LOCAL
[21766]<PHONE_NUMBER>.874213: Resolving hostname samba01.TEST.LOCAL
[21766]<PHONE_NUMBER>.874516: Sending initial UDP request to dgram 192.168.xx.yy:88
[21766]<PHONE_NUMBER>.875944: Received answer (269 bytes) from dgram 192.168.xx.yy:88
[21766]<PHONE_NUMBER>.875969: Response was from master KDC
[21766]<PHONE_NUMBER>.876011: Received error from KDC: -1765328359/Additional pre-authentication required
[21766]<PHONE_NUMBER>.876044: Processing preauth types: 16, 15, 2, 11, 19
[21766]<PHONE_NUMBER>.876056: Selected etype info: etype rc4-hmac, salt "", params ""
[21766]<PHONE_NUMBER>.876081: AS key obtained for encrypted timestamp: rc4-hmac/3053
[21766]<PHONE_NUMBER>.876127: Encrypted timestamp (for<PHONE_NUMBER>.873493): plain longnumber, encrypted longlongnumber
[21766]<PHONE_NUMBER>.876146: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
[21766]<PHONE_NUMBER>.876151: Produced preauth for next request: 2
[21766]<PHONE_NUMBER>.876167: Sending request (247 bytes) to TEST.LOCAL
[21766]<PHONE_NUMBER>.876178: Resolving hostname samba01.TEST.LOCAL
[21766]<PHONE_NUMBER>.876480: Sending initial UDP request to dgram 192.168.xx.yy:88
[21766]<PHONE_NUMBER>.877975: Received answer (143 bytes) from dgram 192.168.xx.yy:88
[21766]<PHONE_NUMBER>.878012: Response was from master KDC
[21766]<PHONE_NUMBER>.878033: Received error from KDC: -1765328360/Preauthentication failed
[10:19:15:726] [21766:21767] [ERROR][com.winpr.sspi.Kerberos] - error while getting credentials
[10:19:15:726] [21766:21767] [ERROR][com.winpr.sspi.Kerberos] - Kerberos credentials not found and could not be acquired
[10:19:15:726] [21766:21767] [WARN][com.winpr.negotiate] - No Kerberos credentials. Retry with NTLM
[10:19:15:726] [21766:21767] [DEBUG][com.winpr.sspi.gss] - gss_release_name: SEC_E_OK (0x00000000)
[10:19:15:726] [21766:21767] [WARN][com.winpr.sspi] - InitializeSecurityContextA status SEC_E_NO_CREDENTIALS [0x8009030E]
[10:19:15:726] [21766:21767] [TRACE][com.freerdp.core.nla] -  InitializeSecurityContext status SEC_E_NO_CREDENTIALS [0x8009030E]
*** Error in `./client/X11/xfreerdp': corrupted double-linked list: 0x00007f30f0006510 ***

@bmiklautz can run that in valgrind, I guess it will find the faulty location even if it doesn't crash all the time

Did some leak fixes with https://github.com/akallabeth/FreeRDP/tree/kerberos_leak_fixes (rebased to current master)

I've completed a standard installation of Samba AD-DC and it's working well. Exactly the same way that with Windows Server AD/KDC that I was using for now.
The only little tricky point was exactly the same error @hardening described when he tried to make Kerberos running with Samba weeks ago. I don't know if you've made progress since then ?
At this time I said :

@hardening according to your tickets it seems you are well authenticated against Kerberos. But there is something strange. In your gist file, logs are dated to [16:53:58] while the TGS is only valid after [19:47:28].
Are the client and server clocks well synchronized ?

My remote host's clock was not synchronized with client and Samba. Since Kerberos allows by default only 5mn clock skew, synchronize all the clock entities solved my problem.

Yes I could connect to the remote host.
What I figured was that the segfaults happens if you use the IP address of an host that doesn't have an reverse DNS entry. Or try to connect to a host that isn't in the domain.
The segfault doesn't happen every time but quite frequently (something like every second or third time). All logs were attached. No more messages (even with debug level set to TRACE).

I've made different tests but none ended with segfaults...
As said here https://stackoverflow.com/questions/12260587/kerberos-fails-when-accessing-site-by-ip-address :

Kerberos does not work with IP adresses, it relies on domain names and correct DNS entries only.

or here https://support.microsoft.com/en-ca/help/322979/kerberos-is-not-used-when-you-connect-to-smb-shares-by-using-ip-addres :

This behavior is by design.

About your tests :

What I've seen is that the tgt is renewed (or re-created) when xfreerdp is run. - I ran kinit and got a tgt after running xfreerdp the 'valid starting' when klist is run was different. Which isn't a big problem but it seems the tgt gets cleaned/removed in some cases:
- get a tgt with kinit
- connect to any host that is not in the domain (IP or DNS name that is not joined the domain but connectable with RDP)
- if the connection was successful the TGT is gone

Note that I observe the same behaviour with Samba and Windows server in the tests below.
When doing kinit before starting xfreerdp, the TGT emitted by kinit is used. Only TGS  is created like you can see :
$ kinit administrator
[...]
Password for<EMAIL_ADDRESS>
[...]
[27561]<PHONE_NUMBER>.815091: Storing<EMAIL_ADDRESS>-> krb5_ccache_conf_data/pa_type/krbtgt\/FR.DORIAN.TECH\@FR.DORIAN.TECH@X-CACHECONF: in FILE:/tmp/krb5cc_1000
Warning: Your password will expire in 37 days on ven. 01 sept. 2017 17:22:51 CEST
$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal<EMAIL_ADDRESS>
Valid starting       Expires              Service principal
26/07/2017 14:43:12  27/07/2017 00:43:12<EMAIL_ADDRESS>    renew until 27/07/2017 14:43:04
$ ./xfreerdp /u:administrator /v:windorian /p:"password"
[27721]<PHONE_NUMBER>.854300: ccselect module realm chose cache FILE:/tmp/krb5cc_1000 with client principal<EMAIL_ADDRESS>for server principal<EMAIL_ADDRESS>[27721]<PHONE_NUMBER>.854380: Getting credentials<EMAIL_ADDRESS>-><EMAIL_ADDRESS>using ccache FILE:/tmp/krb5cc_1000
[27721]<PHONE_NUMBER>.854458: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[27721]<PHONE_NUMBER>.854505: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: 0/Success
[27721]<PHONE_NUMBER>.854519: Starting with TGT for client realm<EMAIL_ADDRESS>-><EMAIL_ADDRESS>[27721]<PHONE_NUMBER>.854523: Requesting tickets for<EMAIL_ADDRESS>referrals on
[...]
[27721]<PHONE_NUMBER>.879425: Response was from master KDC
[27721]<PHONE_NUMBER>.879437: Got cred; -1765328371/KDC can't fulfill requested option
[27721]<PHONE_NUMBER>.879468: Creating authenticator for<EMAIL_ADDRESS>-><EMAIL_ADDRESS>seqnum 842153415, subkey aes256-cts/2428, session key aes256-cts/4FEF
[27721]<PHONE_NUMBER>.883910: Read AP-REP, time<PHONE_NUMBER>.879473, subkey aes256-cts/CADC, seqnum<PHONE_NUMBER>
[14:44:08:056] [27721:27722] [INFO][com.freerdp.gdi] - Local framebuffer format  PIXEL_FORMAT_BGRX32
[14:44:08:056] [27721:27722] [INFO][com.freerdp.gdi] - Remote framebuffer format PIXEL_FORMAT_RGB16
[14:44:08:078] [27721:27722] [INFO][com.winpr.clipboard] - initialized POSIX local file subsystem
[14:44:13:607] [27721:27722] [INFO][com.freerdp.client.x11] - Closed from X11
$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal<EMAIL_ADDRESS>
Valid starting       Expires              Service principal
26/07/2017 14:43:12  27/07/2017 00:43:12<EMAIL_ADDRESS>    renew until 27/07/2017 14:43:04
26/07/2017 14:43:58  27/07/2017 00:43:12<EMAIL_ADDRESS>    renew until 27/07/2017 14:43:04

If I'm using IP instead of hostname :
$ ./xfreerdp /u:administrator /v:10.237.xx.yy /p:"password"
[...]
[10:45:18:034] [15215:15216] [INFO][com.winpr.sspi.Kerberos] - Authenticated to Kerberos v5 via login/password
[...]
[15215]<PHONE_NUMBER>.952965: TGS request result: -1765328377/Server not found in Kerberos database
[10:45:18:057] [15215:15216] [ERROR][com.winpr.sspi.Kerberos] - Init GSS security context failed : can't use Kerberos
[10:45:18:057] [15215:15216] [WARN][com.winpr.sspi] - InitializeSecurityContextA status SEC_E_INTERNAL_ERROR [0x80090304]
[10:45:18:057] [15215:15216] [ERROR][com.freerdp.core] - freerdp_set_last_error ERRCONNECT_AUTHENTICATION_FAILED [0x00020009]
[10:45:18:057] [15215:15216] [ERROR][com.freerdp.core.connection] - Error: protocol security negotiation or connection failure
[10:45:18:057] [15215:15216] [ERROR][com.freerdp.client.x11] - Freerdp connect error exit status 1
$ klist
Credentials cache: FILE:/tmp/krb5cc_1000
        Principal<EMAIL_ADDRESS>
  Issued                Expires               Principal
Jul 26 10:46:26 2017  Jul 27 20:46:26 2017<EMAIL_ADDRESS>
So I got the error "Server not found in Kerberos database" which ends the program. But no segfault and no NTLM fallback by the way, once we are authenticated to Kerberos when we get TGT.
Note that if for some reasons you're not getting TGS succesfully (by using IP for example) at the end you will have the error mentioned previously "Server not found in Kerberos database". And so the following time you will be running xfreerdp it will try to use the only ticket, i.e. TGT, and will try to obtain TGS but will fail like the last time we ran xfreerdp. And then restart the process from the beginning by getting a new TGT (erasing the former one by the way) and will try to get the corresponding TGS. If it still fails at the TGS-getting stage, we will have the same error "Server not found in Kerberos database" one more time, and program ended.
Have a look at the following :
Using IP with only valid TGT at start :
$ klist
Credentials cache: FILE:/tmp/krb5cc_1000
        Principal<EMAIL_ADDRESS>
  Issued                Expires               Principal
Jul 27 16:32:15 2017  Jul 28 02:32:15 2017<EMAIL_ADDRESS>$ ./xfreerdp /v:10.237.xx.yy /u:administrator /p:"password"
[12738]<PHONE_NUMBER>.178404: ccselect can't find appropriate cache for server principal TERMSRV/10.237.xx.yy@
[12738]<PHONE_NUMBER>.178587: Getting credentials<EMAIL_ADDRESS>-> TERMSRV/10.237.xx.yy@ using ccache FILE:/tmp/krb5cc_1000
[12738]<PHONE_NUMBER>.178732: Retrieving<EMAIL_ADDRESS>-> TERMSRV/10.237.xx.yy@ from FILE:/tmp/krb5cc_1000 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[12738]<PHONE_NUMBER>.178794: Retrying<EMAIL_ADDRESS>-><EMAIL_ADDRESS>with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[12738]<PHONE_NUMBER>.178813: Server has referral realm; starting with<EMAIL_ADDRESS>[12738]<PHONE_NUMBER>.178903: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: 0/Success
[12738]<PHONE_NUMBER>.178927: Starting with TGT for client realm<EMAIL_ADDRESS>-><EMAIL_ADDRESS>[12738]<PHONE_NUMBER>.178938: Requesting tickets for<EMAIL_ADDRESS>referrals on
[12738]<PHONE_NUMBER>.179004: Generated subkey for TGS request: aes256-cts/61A6
[12738]<PHONE_NUMBER>.179106: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[12738]<PHONE_NUMBER>.179272: Encoding request body and padata into FAST request
[12738]<PHONE_NUMBER>.179375: Sending request (1600 bytes) to FR.DORIAN.TECH
[12738]<PHONE_NUMBER>.179452: Resolving hostname 10.237.xx.yy
[12738]<PHONE_NUMBER>.179527: Initiating TCP connection to stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.179963: Sending TCP request to stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.190895: Received answer (107 bytes) from stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.190914: Terminating TCP connection to stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.191027: Response was from master KDC
[12738]<PHONE_NUMBER>.191050: TGS request result: -1765328377/Server not found in Kerberos database
[12738]<PHONE_NUMBER>.191178: Requesting tickets for<EMAIL_ADDRESS>referrals off
[12738]<PHONE_NUMBER>.191261: Generated subkey for TGS request: aes256-cts/6DCA
[12738]<PHONE_NUMBER>.191361: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[12738]<PHONE_NUMBER>.191513: Encoding request body and padata into FAST request
[12738]<PHONE_NUMBER>.191621: Sending request (1600 bytes) to FR.DORIAN.TECH
[12738]<PHONE_NUMBER>.191694: Resolving hostname 10.237.xx.yy
[12738]<PHONE_NUMBER>.191792: Initiating TCP connection to stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.192289: Sending TCP request to stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.196962: Received answer (107 bytes) from stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.197032: Terminating TCP connection to stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.197238: Response was from master KDC
[12738]<PHONE_NUMBER>.197347: TGS request result: -1765328377/Server not found in Kerberos database
[12738]<PHONE_NUMBER>.198319: Initializing FILE:/tmp/krb5cc_1000 with default princ<EMAIL_ADDRESS>[12738]<PHONE_NUMBER>.198431: Getting initial credentials for<EMAIL_ADDRESS>[12738]<PHONE_NUMBER>.199534: Sending request (185 bytes) to FR.DORIAN.TECH
[12738]<PHONE_NUMBER>.199587: Resolving hostname 10.237.xx.yy
[12738]<PHONE_NUMBER>.199664: Sending initial UDP request to dgram 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.202816: Received answer (293 bytes) from dgram 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.202849: Response was from master KDC
[12738]<PHONE_NUMBER>.202876: Received error from KDC: -1765328359/Additional pre-authentication required
[12738]<PHONE_NUMBER>.202922: Processing preauth types: 16, 15, 2, 19
[12738]<PHONE_NUMBER>.202938: Selected etype info: etype aes256-cts, salt "FR.DORIAN.TECHAdministrator", params "\x00\x00\x10\x00"
[12738]<PHONE_NUMBER>.202999: PKINIT client has no configured identity; giving up
[12738]<PHONE_NUMBER>.203031: PKINIT client has no configured identity; giving up
[12738]<PHONE_NUMBER>.203046: Preauth module pkinit (16) (real) returned: 22/Argument invalide
[12738]<PHONE_NUMBER>.203051: PKINIT client ignoring draft 9 offer from RFC 4556 KDC
[12738]<PHONE_NUMBER>.203056: Preauth module pkinit (15) (real) returned: -1765328360/Preauthentication failed
[12738]<PHONE_NUMBER>.218434: AS key obtained for encrypted timestamp: aes256-cts/8C17
[12738]<PHONE_NUMBER>.218510: Encrypted timestamp (for<PHONE_NUMBER>.659347): plain 301AA011180F32303137303732373134333232395AA10502030A0F93, encrypted 15D2B55C8AF7CAC911B6F9F36D50A8B1E92CBB5541DBF41708AD9FEB3BFAA3C97CF6B83D7D30A6C22B1305C0EA40DCC0C33DC7F66B8EC7CC
[12738]<PHONE_NUMBER>.218543: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
[12738]<PHONE_NUMBER>.218551: Produced preauth for next request: 2
[12738]<PHONE_NUMBER>.218572: Sending request (265 bytes) to FR.DORIAN.TECH
[12738]<PHONE_NUMBER>.218597: Resolving hostname 10.237.xx.yy
[12738]<PHONE_NUMBER>.218674: Sending initial UDP request to dgram 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.337154: Received answer (1389 bytes) from dgram 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.337214: Response was from master KDC
[12738]<PHONE_NUMBER>.337271: Processing preauth types: 3
[12738]<PHONE_NUMBER>.337279: Received salt "FR.DORIAN.TECHAdministrator" via padata type 3
[12738]<PHONE_NUMBER>.337304: Produced preauth for next request: (empty)
[12738]<PHONE_NUMBER>.337324: AS key determined by preauth: aes256-cts/8C17
[12738]<PHONE_NUMBER>.337413: Decrypted AS reply; session key is: aes256-cts/F3D8
[12738]<PHONE_NUMBER>.337420: FAST negotiation: unavailable
[12738]<PHONE_NUMBER>.337451: Initializing FILE:/tmp/krb5cc_1000 with default princ<EMAIL_ADDRESS>[12738]<PHONE_NUMBER>.337534: Storing<EMAIL_ADDRESS>-><EMAIL_ADDRESS>in FILE:/tmp/krb5cc_1000
[12738]<PHONE_NUMBER>.337602: Storing config in FILE:/tmp/krb5cc_1000 for<EMAIL_ADDRESS>pa_type: 2
[12738]<PHONE_NUMBER>.337657: Storing<EMAIL_ADDRESS>-> krb5_ccache_conf_data/pa_type/krbtgt\/FR.DORIAN.TECH\@FR.DORIAN.TECH@X-CACHECONF: in FILE:/tmp/krb5cc_1000
[16:32:41:283] [12738:12739] [INFO][com.winpr.sspi.Kerberos] - Authenticated to Kerberos v5 via login/password
[12738]<PHONE_NUMBER>.342493: ccselect can't find appropriate cache for server principal TERMSRV/10.237.xx.yy@
[12738]<PHONE_NUMBER>.342603: Getting credentials<EMAIL_ADDRESS>-> TERMSRV/10.237.xx.yy@ using ccache FILE:/tmp/krb5cc_1000
[12738]<PHONE_NUMBER>.342685: Retrieving<EMAIL_ADDRESS>-> TERMSRV/10.237.xx.yy@ from FILE:/tmp/krb5cc_1000 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[12738]<PHONE_NUMBER>.342749: Retrying<EMAIL_ADDRESS>-><EMAIL_ADDRESS>with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[12738]<PHONE_NUMBER>.342759: Server has referral realm; starting with<EMAIL_ADDRESS>[12738]<PHONE_NUMBER>.342821: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: 0/Success
[12738]<PHONE_NUMBER>.342830: Starting with TGT for client realm<EMAIL_ADDRESS>-><EMAIL_ADDRESS>[12738]<PHONE_NUMBER>.342835: Requesting tickets for<EMAIL_ADDRESS>referrals on
[12738]<PHONE_NUMBER>.342861: Generated subkey for TGS request: aes256-cts/E22D
[12738]<PHONE_NUMBER>.342925: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[12738]<PHONE_NUMBER>.343010: Encoding request body and padata into FAST request
[12738]<PHONE_NUMBER>.343084: Sending request (1619 bytes) to FR.DORIAN.TECH
[12738]<PHONE_NUMBER>.343146: Resolving hostname 10.237.xx.yy
[12738]<PHONE_NUMBER>.343207: Initiating TCP connection to stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.343708: Sending TCP request to stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.350614: Received answer (107 bytes) from stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.350634: Terminating TCP connection to stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.350677: Response was from master KDC
[12738]<PHONE_NUMBER>.350697: TGS request result: -1765328377/Server not found in Kerberos database
[12738]<PHONE_NUMBER>.350736: Requesting tickets for<EMAIL_ADDRESS>referrals off
[12738]<PHONE_NUMBER>.350770: Generated subkey for TGS request: aes256-cts/8A22
[12738]<PHONE_NUMBER>.350834: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[12738]<PHONE_NUMBER>.350917: Encoding request body and padata into FAST request
[12738]<PHONE_NUMBER>.351001: Sending request (1619 bytes) to FR.DORIAN.TECH
[12738]<PHONE_NUMBER>.351037: Resolving hostname 10.237.xx.yy
[12738]<PHONE_NUMBER>.351101: Initiating TCP connection to stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.351356: Sending TCP request to stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.354427: Received answer (107 bytes) from stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.354438: Terminating TCP connection to stream 10.237.xx.yy:88
[12738]<PHONE_NUMBER>.354469: Response was from master KDC
[12738]<PHONE_NUMBER>.354488: TGS request result: -1765328377/Server not found in Kerberos database
[16:32:41:300] [12738:12739] [ERROR][com.winpr.sspi.Kerberos] - Init GSS security context failed : can't use Kerberos
[16:32:41:300] [12738:12739] [WARN][com.winpr.sspi] - InitializeSecurityContextA status SEC_E_INTERNAL_ERROR [0x80090304]
[16:32:41:300] [12738:12739] [ERROR][com.freerdp.core] - freerdp_set_last_error ERRCONNECT_AUTHENTICATION_FAILED [0x00020009]
[16:32:41:300] [12738:12739] [ERROR][com.freerdp.core.connection] - Error: protocol security negotiation or connection failure
[16:32:41:300] [12738:12739] [ERROR][com.freerdp.client.x11] - Freerdp connect error exit status 1
$ klist
Credentials cache: FILE:/tmp/krb5cc_1000
        Principal<EMAIL_ADDRESS>
  Issued                Expires               Principal
Jul 27 16:32:29 2017  Jul 28 02:32:29 2017<EMAIL_ADDRESS>
Using hostname with only valid TGT at start :
$ klist
Credentials cache: FILE:/tmp/krb5cc_1000
        Principal<EMAIL_ADDRESS>
  Issued                Expires               Principal
Jul 27 16:35:27 2017  Jul 28 02:35:27 2017<EMAIL_ADDRESS>$ ./xfreerdp /v:windorian /u:administrator /p:"password"
[13410]<PHONE_NUMBER>.847586: ccselect module realm chose cache FILE:/tmp/krb5cc_1000 with client principal<EMAIL_ADDRESS>for server principal<EMAIL_ADDRESS>[13410]<PHONE_NUMBER>.847744: Getting credentials<EMAIL_ADDRESS>-><EMAIL_ADDRESS>using ccache FILE:/tmp/krb5cc_1000
[13410]<PHONE_NUMBER>.847880: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[13410]<PHONE_NUMBER>.847994: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: 0/Success
[13410]<PHONE_NUMBER>.848018: Starting with TGT for client realm<EMAIL_ADDRESS>-><EMAIL_ADDRESS>[13410]<PHONE_NUMBER>.848031: Requesting tickets for<EMAIL_ADDRESS>referrals on
[13410]<PHONE_NUMBER>.848082: Generated subkey for TGS request: aes256-cts/AA89
[13410]<PHONE_NUMBER>.848194: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[13410]<PHONE_NUMBER>.848368: Encoding request body and padata into FAST request
[13410]<PHONE_NUMBER>.848465: Sending request (1628 bytes) to FR.DORIAN.TECH
[13410]<PHONE_NUMBER>.848545: Resolving hostname 10.237.xx.yy
[13410]<PHONE_NUMBER>.848618: Initiating TCP connection to stream 10.237.xx.yy:88
[13410]<PHONE_NUMBER>.849075: Sending TCP request to stream 10.237.xx.yy:88
[13410]<PHONE_NUMBER>.860740: Received answer (1343 bytes) from stream 10.237.xx.yy:88
[13410]<PHONE_NUMBER>.860754: Terminating TCP connection to stream 10.237.xx.yy:88
[13410]<PHONE_NUMBER>.860841: Response was from master KDC
[13410]<PHONE_NUMBER>.860881: Decoding FAST response
[13410]<PHONE_NUMBER>.861038: TGS reply is for<EMAIL_ADDRESS>-><EMAIL_ADDRESS>with session key aes256-cts/09A2
[13410]<PHONE_NUMBER>.861100: TGS request result: 0/Success
[13410]<PHONE_NUMBER>.861109: Received creds for desired service<EMAIL_ADDRESS>[13410]<PHONE_NUMBER>.861125: Storing<EMAIL_ADDRESS>-><EMAIL_ADDRESS>in FILE:/tmp/krb5cc_1000
[13410]<PHONE_NUMBER>.861503: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: 0/Success
[13410]<PHONE_NUMBER>.861521: Get cred via TGT<EMAIL_ADDRESS>after requesting<EMAIL_ADDRESS>(canonicalize off)
[13410]<PHONE_NUMBER>.861542: Generated subkey for TGS request: aes256-cts/86B8
[13410]<PHONE_NUMBER>.861589: etypes requested in TGS request: aes256-cts
[13410]<PHONE_NUMBER>.861669: Encoding request body and padata into FAST request
[13410]<PHONE_NUMBER>.861747: Sending request (1559 bytes) to FR.DORIAN.TECH
[13410]<PHONE_NUMBER>.861789: Resolving hostname 10.237.xx.yy
[13410]<PHONE_NUMBER>.861863: Initiating TCP connection to stream 10.237.xx.yy:88
[13410]<PHONE_NUMBER>.862285: Sending TCP request to stream 10.237.xx.yy:88
[13410]<PHONE_NUMBER>.866936: Received answer (1319 bytes) from stream 10.237.xx.yy:88
[13410]<PHONE_NUMBER>.867039: Terminating TCP connection to stream 10.237.xx.yy:88
[13410]<PHONE_NUMBER>.867301: Response was from master KDC
[13410]<PHONE_NUMBER>.867341: Decoding FAST response
[13410]<PHONE_NUMBER>.867466: TGS reply is for<EMAIL_ADDRESS>-><EMAIL_ADDRESS>with session key aes256-cts/F4D1
[13410]<PHONE_NUMBER>.867517: Got cred; 0/Success
[13410]<PHONE_NUMBER>.867730: Creating authenticator for<EMAIL_ADDRESS>-><EMAIL_ADDRESS>seqnum 524882990, subkey aes256-cts/4A03, session key aes256-cts/09A2
[13410]<PHONE_NUMBER>.876961: Read AP-REP, time<PHONE_NUMBER>.867741, subkey aes256-cts/893C, seqnum 477530578
[16:36:12:909] [13410:13411] [INFO][com.freerdp.gdi] - Local framebuffer format  PIXEL_FORMAT_BGRX32
[16:36:12:909] [13410:13411] [INFO][com.freerdp.gdi] - Remote framebuffer format PIXEL_FORMAT_RGB16
[16:36:12:943] [13410:13411] [INFO][com.winpr.clipboard] - initialized POSIX local file subsystem
[16:36:17:687] [13410:13411] [INFO][com.freerdp.client.x11] - Closed from X11
$ klist
Credentials cache: FILE:/tmp/krb5cc_1000
        Principal<EMAIL_ADDRESS>
  Issued                Expires               Principal
Jul 27 16:35:27 2017  Jul 28 02:35:27 2017<EMAIL_ADDRESS>Jul 27 16:36:01 2017  Jul 28 02:35:27 2017<EMAIL_ADDRESS>
Using hostname with valid TGT and TGS from another domain at start :
$ klist
Credentials cache: FILE:/tmp/krb5cc_1000
        Principal<EMAIL_ADDRESS>
  Issued                Expires               Principal
Jul 27 15:22:55 2017  Jul 28 01:22:55 2017<EMAIL_ADDRESS>Jul 27 15:22:55 2017  Jul 28 01:22:55 2017<EMAIL_ADDRESS>$ ./xfreerdp /v:windorian /u:administrator /p:"password"
[32689]<PHONE_NUMBER>.629899: ccselect can't find appropriate cache for server principal<EMAIL_ADDRESS>[32689]<PHONE_NUMBER>.630104: Getting credentials<EMAIL_ADDRESS>-><EMAIL_ADDRESS>using ccache FILE:/tmp/krb5cc_1000
[32689]<PHONE_NUMBER>.630257: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[32689]<PHONE_NUMBER>.630364: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[32689]<PHONE_NUMBER>.630482: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: 0/Success
[32689]<PHONE_NUMBER>.630504: Starting with TGT for client realm<EMAIL_ADDRESS>-><EMAIL_ADDRESS>[32689]<PHONE_NUMBER>.630610: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[32689]<PHONE_NUMBER>.630630: Requesting TGT<EMAIL_ADDRESS>using TGT<EMAIL_ADDRESS>[32689]<PHONE_NUMBER>.630677: Generated subkey for TGS request: aes256-cts/F830
[32689]<PHONE_NUMBER>.630779: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[32689]<PHONE_NUMBER>.630966: Encoding request body and padata into FAST request
[32689]<PHONE_NUMBER>.631088: Sending request (5699 bytes) to AD.WIN
[32689]<PHONE_NUMBER>.642738: Resolving hostname dc01.ad.win.
[32689]<PHONE_NUMBER>.646688: Sending initial UDP request to dgram 10.236.xx.yy:88
[32689]<PHONE_NUMBER>.647829: Resolving hostname dc03.ad.win.
[32689]<PHONE_NUMBER>.656776: Sending initial UDP request to dgram 10.235.xx.yy:88
[32689]<PHONE_NUMBER>.660666: Received answer (84 bytes) from dgram 10.235.xx.yy:88
[32689]<PHONE_NUMBER>.674181: Response was not from master KDC
[32689]<PHONE_NUMBER>.674267: Request or response is too big for UDP; retrying with TCP
[32689]<PHONE_NUMBER>.674278: Sending request (5699 bytes) to AD.WIN (tcp only)
[32689]<PHONE_NUMBER>.687309: Resolving hostname dc03.ad.win.
[32689]<PHONE_NUMBER>.693614: Initiating TCP connection to stream 10.235.xx.yy:88
[32689]<PHONE_NUMBER>.697548: Sending TCP request to stream 10.235.xx.yy:88
[32689]<PHONE_NUMBER>.702128: Received answer (311 bytes) from stream 10.235.xx.yy:88
[32689]<PHONE_NUMBER>.702144: Terminating TCP connection to stream 10.235.xx.yy:88
[32689]<PHONE_NUMBER>.719079: Response was not from master KDC
[32689]<PHONE_NUMBER>.719137: Decoding FAST response
[32689]<PHONE_NUMBER>.719242: TGS request result: -1765328377/Server not found in Kerberos database
[32689]<PHONE_NUMBER>.719701: Initializing FILE:/tmp/krb5cc_1000 with default princ<EMAIL_ADDRESS>[32689]<PHONE_NUMBER>.719820: Getting initial credentials for<EMAIL_ADDRESS>[32689]<PHONE_NUMBER>.720648: Sending request (185 bytes) to FR.DORIAN.TECH
[32689]<PHONE_NUMBER>.720706: Resolving hostname 10.237.xx.yy
[32689]<PHONE_NUMBER>.720782: Sending initial UDP request to dgram 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.729110: Received answer (293 bytes) from dgram 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.729172: Response was from master KDC
[32689]<PHONE_NUMBER>.729208: Received error from KDC: -1765328359/Additional pre-authentication required
[32689]<PHONE_NUMBER>.729262: Processing preauth types: 16, 15, 2, 19
[32689]<PHONE_NUMBER>.729279: Selected etype info: etype aes256-cts, salt "FR.DORIAN.TECHAdministrator", params "\x00\x00\x10\x00"
[32689]<PHONE_NUMBER>.729334: PKINIT client has no configured identity; giving up
[32689]<PHONE_NUMBER>.729388: PKINIT client has no configured identity; giving up
[32689]<PHONE_NUMBER>.729403: Preauth module pkinit (16) (real) returned: 22/Argument invalide
[32689]<PHONE_NUMBER>.729412: PKINIT client ignoring draft 9 offer from RFC 4556 KDC
[32689]<PHONE_NUMBER>.729417: Preauth module pkinit (15) (real) returned: -1765328360/Preauthentication failed
[32689]<PHONE_NUMBER>.743827: AS key obtained for encrypted timestamp: aes256-cts/8C17
[32689]<PHONE_NUMBER>.743904: Encrypted timestamp (for<PHONE_NUMBER>.305690): plain 301AA011180F32303137303732373133323331305AA105020304AA1A, encrypted 3D0C016724E925AFB9E4C9C4A8716795C215EEBEBC518CF338911DE0EDCBD6A195A69C50E9E22DDB0DF5198E6CA8ACC66A4DF251933AC063
[32689]<PHONE_NUMBER>.743933: Preauth module encrypted_timestamp (2) (real) returned: 0/Success
[32689]<PHONE_NUMBER>.743941: Produced preauth for next request: 2
[32689]<PHONE_NUMBER>.743974: Sending request (265 bytes) to FR.DORIAN.TECH
[32689]<PHONE_NUMBER>.743992: Resolving hostname 10.237.xx.yy
[32689]<PHONE_NUMBER>.744063: Sending initial UDP request to dgram 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.866892: Received answer (1389 bytes) from dgram 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.866953: Response was from master KDC
[32689]<PHONE_NUMBER>.867004: Processing preauth types: 3
[32689]<PHONE_NUMBER>.867011: Received salt "FR.DORIAN.TECHAdministrator" via padata type 3
[32689]<PHONE_NUMBER>.867017: Produced preauth for next request: (empty)
[32689]<PHONE_NUMBER>.867037: AS key determined by preauth: aes256-cts/8C17
[32689]<PHONE_NUMBER>.867112: Decrypted AS reply; session key is: aes256-cts/E212
[32689]<PHONE_NUMBER>.867118: FAST negotiation: unavailable
[32689]<PHONE_NUMBER>.867158: Initializing FILE:/tmp/krb5cc_1000 with default princ<EMAIL_ADDRESS>[32689]<PHONE_NUMBER>.867242: Storing<EMAIL_ADDRESS>-><EMAIL_ADDRESS>in FILE:/tmp/krb5cc_1000
[32689]<PHONE_NUMBER>.867312: Storing config in FILE:/tmp/krb5cc_1000 for<EMAIL_ADDRESS>pa_type: 2
[32689]<PHONE_NUMBER>.867362: Storing<EMAIL_ADDRESS>-> krb5_ccache_conf_data/pa_type/krbtgt\/FR.DORIAN.TECH\@FR.DORIAN.TECH@X-CACHECONF: in FILE:/tmp/krb5cc_1000
[15:23:21:810] [32689:32690] [INFO][com.winpr.sspi.Kerberos] - Authenticated to Kerberos v5 via login/password
[32689]<PHONE_NUMBER>.868124: ccselect module realm chose cache FILE:/tmp/krb5cc_1000 with client principal<EMAIL_ADDRESS>for server principal<EMAIL_ADDRESS>[32689]<PHONE_NUMBER>.868220: Getting credentials<EMAIL_ADDRESS>-><EMAIL_ADDRESS>using ccache FILE:/tmp/krb5cc_1000
[32689]<PHONE_NUMBER>.868291: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[32689]<PHONE_NUMBER>.868369: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: 0/Success
[32689]<PHONE_NUMBER>.868388: Starting with TGT for client realm<EMAIL_ADDRESS>-><EMAIL_ADDRESS>[32689]<PHONE_NUMBER>.868393: Requesting tickets for<EMAIL_ADDRESS>referrals on
[32689]<PHONE_NUMBER>.868416: Generated subkey for TGS request: aes256-cts/66AF
[32689]<PHONE_NUMBER>.868481: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[32689]<PHONE_NUMBER>.868559: Encoding request body and padata into FAST request
[32689]<PHONE_NUMBER>.868643: Sending request (1647 bytes) to FR.DORIAN.TECH
[32689]<PHONE_NUMBER>.868702: Resolving hostname 10.237.xx.yy
[32689]<PHONE_NUMBER>.868760: Initiating TCP connection to stream 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.869230: Sending TCP request to stream 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.880610: Received answer (1383 bytes) from stream 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.880626: Terminating TCP connection to stream 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.880681: Response was from master KDC
[32689]<PHONE_NUMBER>.880714: Decoding FAST response
[32689]<PHONE_NUMBER>.880828: TGS reply is for<EMAIL_ADDRESS>-><EMAIL_ADDRESS>with session key aes256-cts/0E91
[32689]<PHONE_NUMBER>.880864: TGS request result: 0/Success
[32689]<PHONE_NUMBER>.880872: Received creds for desired service<EMAIL_ADDRESS>[32689]<PHONE_NUMBER>.880890: Storing<EMAIL_ADDRESS>-><EMAIL_ADDRESS>in FILE:/tmp/krb5cc_1000
[32689]<PHONE_NUMBER>.881162: Retrieving<EMAIL_ADDRESS>-><EMAIL_ADDRESS>from FILE:/tmp/krb5cc_1000 with result: 0/Success
[32689]<PHONE_NUMBER>.881180: Get cred via TGT<EMAIL_ADDRESS>after requesting<EMAIL_ADDRESS>(canonicalize off)
[32689]<PHONE_NUMBER>.881204: Generated subkey for TGS request: aes256-cts/1558
[32689]<PHONE_NUMBER>.881246: etypes requested in TGS request: aes256-cts
[32689]<PHONE_NUMBER>.881327: Encoding request body and padata into FAST request
[32689]<PHONE_NUMBER>.881400: Sending request (1617 bytes) to FR.DORIAN.TECH
[32689]<PHONE_NUMBER>.881432: Resolving hostname 10.237.xx.yy
[32689]<PHONE_NUMBER>.881499: Initiating TCP connection to stream 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.881929: Sending TCP request to stream 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.887019: Received answer (107 bytes) from stream 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.887031: Terminating TCP connection to stream 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.887069: Response was from master KDC
[32689]<PHONE_NUMBER>.887092: Got cred; -1765328371/KDC can't fulfill requested option
[32689]<PHONE_NUMBER>.887101: Get cred via TGT<EMAIL_ADDRESS>after requesting<EMAIL_ADDRESS>(canonicalize off)
[32689]<PHONE_NUMBER>.887125: Generated subkey for TGS request: aes256-cts/A338
[32689]<PHONE_NUMBER>.887190: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[32689]<PHONE_NUMBER>.887264: Encoding request body and padata into FAST request
[32689]<PHONE_NUMBER>.887338: Sending request (1663 bytes) to FR.DORIAN.TECH
[32689]<PHONE_NUMBER>.887354: Resolving hostname 10.237.xx.yy
[32689]<PHONE_NUMBER>.887410: Initiating TCP connection to stream 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.887825: Sending TCP request to stream 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.892000: Received answer (107 bytes) from stream 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.892015: Terminating TCP connection to stream 10.237.xx.yy:88
[32689]<PHONE_NUMBER>.892042: Response was from master KDC
[32689]<PHONE_NUMBER>.892067: Got cred; -1765328371/KDC can't fulfill requested option
[32689]<PHONE_NUMBER>.892127: Creating authenticator for<EMAIL_ADDRESS>-><EMAIL_ADDRESS>seqnum 849621172, subkey aes256-cts/B108, session key aes256-cts/0E91
[32689]<PHONE_NUMBER>.901136: Read AP-REP, time<PHONE_NUMBER>.892135, subkey aes256-cts/BBED, seqnum<PHONE_NUMBER>
[15:23:21:928] [32689:32690] [INFO][com.freerdp.gdi] - Local framebuffer format  PIXEL_FORMAT_BGRX32
[15:23:21:928] [32689:32690] [INFO][com.freerdp.gdi] - Remote framebuffer format PIXEL_FORMAT_RGB16
[15:23:22:949] [32689:32690] [INFO][com.winpr.clipboard] - initialized POSIX local file subsystem
[15:23:25:810] [32689:32690] [INFO][com.freerdp.client.x11] - Closed from X11
$ klist
Credentials cache: FILE:/tmp/krb5cc_1000
        Principal<EMAIL_ADDRESS>
  Issued                Expires               Principal
Jul 27 15:23:10 2017  Jul 28 01:23:10 2017<EMAIL_ADDRESS>Jul 27 15:23:10 2017  Jul 28 01:23:10 2017<EMAIL_ADDRESS>

connect to any host that is not in the domain (IP or DNS name that is not joined the domain but connectable with RDP)

Connect to a host that is not belonging to any domain does not make sense with Kerberos since it is all about resolving host and domain names.
Nonetheless, it should not trigger segfault. Maybe to investigate more deeply you could use clang with address sanitizer.
With my current installation I can't reproduce any segfault.
Have you installed the latest version of MIT Kerberos ? I'm using MIT 1.15 and Heimdal 7.3.0 and it's working correctly for both.
Do your KDC is the standard Samba KDC or a KDC you've installed next to Samba DC ? Samba is using Heimdal Kerberos. But it should not cause problem even if you have a MIT standalone KDC (cf. http://cromwell-intl.com/linux/samba-active-directory/samba.html).

@hardening @bmiklautz anything new ? Note that last commit fixes the corrupted double free which happened with MIT version 1.12 or below.

@freerdp-bot test

Up @akallabeth @hardening @bmiklautz

@dodo040 your PR needs rebasing

@dodo040 no need for a rebase I've fixed the conflicts

@freerdp-bot test

@freerdp-bot you're kidding me, right? test!

I've been looking for GSSAPI based RDP logins for quite some time now, and I'd really love to see this integrated into freerdp.
I just compiled latest freerdp git with this PR applied, however on my Ubuntu 16.04 machine I can't get it to work properly: by default I compiled with MIT kerberos (1.13.2), but I cannot get RDP login to work:
Sometimes xfreerdp just crashes, sometimes it hangs (last call gss_acquire_cred).
Good news is: in both cases I got valid TGS before the crash ...
So I decided to compile against Heimdal instead of MIT (hoping for different results), however I was not able to convince cmake to use heimdal libraries. I tried to understand cmake/FindGSSAPI.cmake, but I failed miserably.
Please let me know if I can provide more information to narrow down the remaining problems.

I just compiled latest freerdp git with this PR applied, however on my Ubuntu 16.04 machine I can't get it to work properly: by default I compiled with MIT kerberos (1.13.2), but I cannot get RDP login to work:
Sometimes xfreerdp just crashes, sometimes it hangs (last call gss_acquire_cred).
Good news is: in both cases I got valid TGS before the crash ...

@linuxrrze Compared to this comment you've edited later. I would need your cmake and ldd output to check if you're linking correctly to krb5 v1.13.2

So I decided to compile against Heimdal instead of MIT (hoping for different results), however I was not able to convince cmake to use heimdal libraries. I tried to understand cmake/FindGSSAPI.cmake, but I failed miserably.

Did you export GSS_ROOT_DIR or GSS_ROOT_FLAVOUR before doing cmake (for MIT and Heimdal) ?
Moreover, I've noted 3 tickets and 2 TGS whose one is incorrect and should never appeared.
21.10.2017 09:47:28  21.10.2017 19:47:27  TERMSRV/win10.mydomain.de@
    renew until 22.10.2017 09:47:27

That implies a problem in Kerberos authentication. And then possible trouble to connect to remote host. What is your KDC ?
I don't know yet what your problem is, but already met this behaviour.
It would be helpful if you can post the whole output that xfreerdp gives you with DEBUG level and by doing export KRB5_TRACE=/dev/stdout before starting program.
For Kerberos you don't need to fill the domain argument.

However once the TGT is there I'd expect freerdp do use this ticket for authentication, but I couldn't get that to work. I tried different combinations, but was asked for a password (or even username) with all of them.

This is a normal behaviour for the implementation of this client Kerberos support's PR. But you've raised an interesting topic. Make true SSO with Kerberos. An other PR will be necessary since it requires to implement the recent new feature from Microsoft "Remote Credential Guard" (see [MS-RDPEAR] ). But this type of credentials are only available in Windows 10 and Windows server 2016.
Read these links :
https://social.msdn.microsoft.com/Forums/en-US/da074f0f-0887-4151-88ea-19a671ed91d9/is-it-possible-to-do-true-kerberos-sso-using-rdp-?forum=os_windowsprotocols
https://docs.microsoft.com/en-us/windows/access-protection/remote-credential-guard
https://msdn.microsoft.com/en-us/library/mt739840.aspx

Moreover, I've noted 3 tickets and 2 TGS whose one is incorrect and should never appeared.
21.10.2017 09:47:28  21.10.2017 19:47:27  TERMSRV/win10.mydomain.de@
    renew until 22.10.2017 09:47:27

That implies a problem in Kerberos authentication. And then possible trouble to connect to remote host. What is your KDC ?

My KDC is a samba 4.7.0 DC. I've seen these tickets, but at least for other protocols like SSH the ticket without REALM does not cause any trouble (or at least none I could observe).
However I haven't seen such TGS with a Microsoft Active Directory, so I guess this is some kind of samba related bug.

For Kerberos you don't need to fill the domain argument.

Ah ok ... as I expected the existing ticket to be used, I couldn't make sense of freerdp prompting for username and password anyway. But as you explained, the existing ticket is not (yet) used - so username/password is still needed.

However once the TGT is there I'd expect freerdp do use this ticket for authentication, but I couldn't get that to work. I tried different combinations, but was asked for a password (or even username) with all of them.
This is a normal behaviour for the implementation of this client Kerberos support's PR. But you've raised an interesting topic. Make true SSO with Kerberos. An other PR will be necessary since it requires to implement the recent new feature from Microsoft "Remote Credential Guard" (see [MS-RDPEAR] ). But this type of credentials are only available in Windows 10 and Windows server 2016.

Thanks for explaining that - so for now I can stop trying to get this working.
However I'd really love to see that feature in FreeRDP

@hardening @bmiklautz @mfleisz anyone interested in having a second look at this one?

I just compiled latest freerdp git with this PR applied, however on my Ubuntu 16.04 machine I can't get it to work properly: by default I compiled with MIT kerberos (1.13.2), but I cannot get RDP login to work:
Sometimes xfreerdp just crashes, sometimes it hangs (last call gss_acquire_cred).
Good news is: in both cases I got valid TGS before the crash ...

@linuxrrze Compared to this comment you've edited later. I would need your cmake and ldd output to check if you're linking correctly to krb5 v1.13.2

So I decided to compile against Heimdal instead of MIT (hoping for different results), however I was not able to convince cmake to use heimdal libraries. I tried to understand cmake/FindGSSAPI.cmake, but I failed miserably.

Did you export GSS_ROOT_DIR or GSS_ROOT_FLAVOUR before doing cmake (for MIT and Heimdal) ?

@linuxrrze and what about crashes you had ? Did you finally succeed to link against Heimdal ? Do not hesitate to give me outputs. It's helpful for me if I need to fix bugs which might be left.

My KDC is a samba 4.7.0 DC. I've seen these tickets, but at least for other protocols like SSH the ticket without REALM does not cause any trouble (or at least none I could observe).
However I haven't seen such TGS with a Microsoft Active Directory, so I guess this is some kind of samba related bug.

I'm using Microsoft Active Directory and Samba 4.3.11 but both give me only two tickets (TGT/TGS).

@linuxrrze and what about crashes you had ? Did you finally succeed to link against Heimdal ? Do not hesitate to give me outputs. It's helpful for me if I need to fix bugs which might be left.

After recompiling and redeploying freerdp (with MIT kerberos) the crashes vanished - maybe I had some kind of mixed old/new libraries installed causing the trouble. Currently I cannot reproduce the crashes I observed at the very beginning (I'll send detailed reports if that changes).
Concerning compiling/linking with heimdal: I tried quite a few things to convince freerdp to link against heimdal without success (but as I used a build service with limited access for building, debugging possibilities are quite limited, System was Ubuntu 16.04).

I'm using Microsoft Active Directory and Samba 4.3.11 but both give me only two tickets (TGT/TGS).

Oh ... nice to know. So I'll check my Samba / krb5 setup.

@linuxrrze Great to know it works as expected. But yes the Kerberos configuration file require at least the following parameters to work properly :
[libdefaults]
        default_realm = EXAMPLE.COM

[realms]
        EXAMPLE.COM = {
                kdc = XXX.XXX.XXX.XXX
                admin_server = XXX.XXX.XXX.XXX
                master_kdc = XXX.XXX.XXX.XXX
                default_domain = example.com
    }

[domain_realm]
        .example.com = EXAMPLE.COM
        example.com = EXAMPLE.COM

Concerning compiling/linking with heimdal: I tried quite a few things to convince freerdp to link against heimdal without success (but as I used a build service with limited access for building, debugging possibilities are quite limited, System was Ubuntu 16.04).

Just export GSS_ROOT_DIR=/usr/heimdal where /usr/heimdal is the prefix of Heimdal Kerberos (krb5-config --prefix) and you should be good. Tell me if you meet any trouble.
$ ldd client/X11/xfreerdp | grep heimdal
    libgssapi.so.3 => /usr/heimdal/lib/libgssapi.so.3 (0x00007f811e7fa000)
    libkrb5.so.26 => /usr/heimdal/lib/libkrb5.so.26 (0x00007f811e569000)
    libkafs.so.0 => /usr/heimdal/lib/libkafs.so.0 (0x00007f811e360000)
    libroken.so.18 => /usr/heimdal/lib/libroken.so.18 (0x00007f811e14a000)
    libheimntlm.so.0 => /usr/heimdal/lib/libheimntlm.so.0 (0x00007f8119447000)
    libasn1.so.8 => /usr/heimdal/lib/libasn1.so.8 (0x00007f811919e000)
    libcom_err.so.1 => /usr/heimdal/lib/libcom_err.so.1 (0x00007f8118f9a000)
    libhcrypto.so.4 => /usr/heimdal/lib/libhcrypto.so.4 (0x00007f8118d5f000)
    libwind.so.0 => /usr/heimdal/lib/libwind.so.0 (0x00007f8118b36000)
    libheimbase.so.1 => /usr/heimdal/lib/libheimbase.so.1 (0x00007f8118927000)
    libhx509.so.5 => /usr/heimdal/lib/libhx509.so.5 (0x00007f81186da000)
    libheimsqlite.so.0 => /usr/heimdal/lib/libheimsqlite.so.0 (0x00007f8118432000)

Just a short update on the build issue with heimdal on Ubuntu 16.04:
Ubuntu packages do not provide a single directory containing the heimdal libraries and includes.
Instead libraries are located in the default path + '/heimdal' (/usr/lib/x86_64-linux-gnu/heimdal/) as are the include files ('/usr/include/heimdal').
krb5config provides the correct compiler/linker options, but they seem to be ignored during configure (see below).

buildhost $ krb5-config --libs
-L/usr/lib/x86_64-linux-gnu/heimdal -lkrb5
buildhost $ krb5-config --cflags
-I/usr/include/heimdal

Here's part of the build log:

buildhost $ GSS_ROOT_FLAVOUR=heimdal GSS_ROOT_DIR=/usr dh_auto_configure  ...
<...>
|  124s] -- Finding optional feature GSSAPI for auth (add kerberos support)
[  124s] CMake Warning at cmake/FindGSSAPI.cmake:245 (message):
[  124s]   Try to set PKG_CONFIG_PATH to PREFIX_OF_KERBEROS/lib/pkgconfig
[  124s] Call Stack (most recent call first):
[  124s]   cmake/FindFeature.cmake:31 (find_package)
[  124s]   CMakeLists.txt:779 (find_feature)
[  124s]
[  124s]
[  124s] -- Could NOT find GSS, try to set the path to GSS root folder in the system variable GSS_ROOT_DIR (missing:  GSS_LIBRARIES) (found version "heimdal 1.6.99
[  124s] ")
[  124s] CMake Warning at CMakeLists.txt:782 (message):
[  124s]   -DWITH_GSSAPI=ON is set, but not GSSAPI implementation was found, disabling

@linuxrrze Looks like it is not able to find the packageconfig of heimdal.  /usr/lib/x86_64-linux-gnu/pkgconfig/ (package heimdal-dev)

@akallabeth Maybe, but it's located in (Ubuntu's) standard location and pkg-config seems to find it:
buildhost $ dpkg -L heimdal-multidev | grep pc
/usr/lib/x86_64-linux-gnu/pkgconfig/heimdal-kadm-server.pc
/usr/lib/x86_64-linux-gnu/pkgconfig/kafs.pc
/usr/lib/x86_64-linux-gnu/pkgconfig/heimdal-krb5.pc
/usr/lib/x86_64-linux-gnu/pkgconfig/heimdal-gssapi.pc
/usr/lib/x86_64-linux-gnu/pkgconfig/heimdal-kadm-client.pc

buildhost $ pkg-config heimdal-gssapi --cflags
-I/usr/include/heimdal

buildhost $ pkg-config heimdal-gssapi --libs
-L/usr/lib/x86_64-linux-gnu/heimdal -lgssapi

@linuxrrze From what I can see in the CMake script is that if you export both, GSS_ROOT_FLAVOUR and GSS_ROOT_DIR pkgconfig paths are not used. Have you tried without GSS_ROOT_DIR only with GSS_ROOT_FLAVOUR ?

@akallabeth Using only GSS_ROOT_FLAVOUR=heimal I get the very same error message.

@hardening Mind to have another look at this one?

@dodo040 Could you rebase and force push your branch to current master? (and maybe check the heimdal issue @linuxrrze pointed out)
@hardening @bmiklautz @mfleisz  I'm in favor of merging, as this pull now looks good enough. Remaining issues can be fixed once more widespread testing is done.

I'm fine with merging this 👍

@akallabeth I'm checking the heimdal issue. Yes I'll do the rebase and force push soon.