[komat@localhost firefox]$ klist
Ticket cache: KCM:1000:4294915407
Default principal: stransky@FEDORAPROJECT.ORG

Valid starting Expires Service principal
12/17/2019 15:03:35 12/18/2019 14:58:45 HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG
12/17/2019 14:58:50 12/18/2019 14:58:45 krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
12/17/2019 14:58:59 12/18/2019 14:58:45 HTTP/proxy01.fedoraproject.org@FEDORAPROJECT.ORG
12/17/2019 15:11:01 12/18/2019 14:58:45 HTTP/id.fedoraproject.org@FEDORAPROJECT.ORG

It is more for fedora infra, than for koji devel. Anyway, I'm able to log in to fedora's koji without any problems with current koji client (1.19.1). Did this change with some update, or is it purely infra issue?

Sounds like you have 'rdns = true' in /etc/krb5.conf or one of the configs in /etc/krb5.conf.d/*

set that to 'false', kdestroy any existing tickets and get a new one.

Sounds like you have 'rdns = true' in /etc/krb5.conf or one of the configs in /etc/krb5.conf.d/*
set that to 'false', kdestroy any existing tickets and get a new one.

No I don't have any 'rdns' entry there. I added 'rdns = false' to /etc/krb5.conf.d/fedoraproject_org
but it still fails.

This is a clean Fedora 31 install. I have an older laptop where I updated from F30 to F31 and the koji works there.

There could be also krb_rdns = true in koji.conf. But it would be weird.
I've tried clean f31 with updates in podman and it works for me out of the box.

I have at koji.conf:

authtype = kerberos
krb_rdns = false

It should work out of the box I would think...

you could also try:

dns_canonicalize_hostname = false
dns_lookup_realm = false

and make sure fedora-packager is installed? (it puts a file in /etc/krb5.conf.d/)

It should work out of the box I would think...
you could also try:
dns_canonicalize_hostname = false
dns_lookup_realm = false

There's no difference

and make sure fedora-packager is installed? (it puts a file in /etc/krb5.conf.d/)

I have fedora-packager-0.6.0.2-6.fc31.noarch

@stransky any update on this?

@stransky any update on this?

I checked it and it's still the same, I can't build packages in Koji.

I upgraded one of my test box from F30 to F31 and koji works there (as it worked on F30 before). But on my primary laptop with clean F31 install the koji fails.

Interesting, can you compare krb5.conf and koji.conf for these two envs?

Sorry, I've missed your mail with results. Can you try also krb_canon_host=True in /etc/koji.conf (and ensure, that you've python-dns installed). It it doesn't work, can you try both values for krb_rdns with this setting?

It works now although I did nothing expect some dnf updates. So closing for now, Thanks.

I see the issue again. I also updated by old F30 system to F32 and I see it there too.
It looks like an intermittent problem - when I run the "brew build" command twenty time, once is successful. I don't know if that's a network issue or so. I fails from my home and also from Brno office.

krb_canon_host=True in /etc/koji.conf and python-dns installed seems to be working so far.

So the krb_canon_host=True in /etc/koji.conf and python-dns do not work any more. It worked somehow (once from ten times) but I'm unable to do any builds again. I suspect it's related to office/vpn setup and it works better when I'm connected from home without vpn.

So shall I move the ticket to fedora infra?

@kevin?

infrastructure is likely the better place, but I'm happy to try and help here.

@stransky can you again share your /etc/krb5.conf and any /etc/krb5.conf.d/* files and the output of: 'KRB5_TRACE=/dev/stdout fedpkg build' ?

I know the stock files work fine, so it has to be something added/changed there....

Log when koji fails:

Log when koji works:

[komat@localhost ~]$ ll /etc/krb5.conf.d/*
lrwxrwxrwx. 1 root root 42 Feb 14 17:21 /etc/krb5.conf.d/crypto-policies -> /etc/crypto-policies/back-ends/krb5.config
-rw-r--r--. 1 root root 256 Mar 3 15:00 /etc/krb5.conf.d/fedoraproject_org
-rw-r--r--. 1 root root 494 Feb 27 04:55 /etc/krb5.conf.d/kcm_default_ccache
-rw-r--r--. 1 root root 423 May 1 2018 /etc/krb5.conf.d/krb5-redhat.conf
-rw-r--r--. 1 root root 205 Jul 31 2017 /etc/krb5.conf.d/stg_fedoraproject_org

From the log it looks like I don't get reply from koji so this line is missing in log-bad.txt:

[6183] 1583311272.592060: Read AP-REP, time 1583311271.396121, subkey aes256-cts/2EDC, seqnum 774979823

The problem is that it's doing reverse dns lookup. (Note the 'proxy01' and 'proxy10' in there). I am not sure why proxy10 works, they should both fail I would think...
It should be using 'server principal HTTP/koji.fedoraproject.org@FEDORAPROJECT.ORG'

Can you look at:

grep rdns /etc/krb5 /etc/krb5.conf.d/

It might be set to 'false' in the top level, but then set back to 'true' in the redhat one?

Also, perhaps try commenting everything in the krb5-redhat.conf one and put the default /etc/krb5.conf back in place, see if it works, then slowly uncomment and see if you can see what might break it there? It should really work out of the box...

It doesn't work even when I have only fedoraproject.org kerberos files and only fedora kerberos ticket (checked by klist). Also I don't have rdns anywhere. I also reinstalled fedpkg/fedora-maintainer packages. I don't have any problem with "fedpkg upload", only koji fails when VPN (BRQ) is on and works when VPN (BRQ) is off. It's also broken when I submit koji builds from BRQ RH office.

Thats interesting... I wonder if the vpn is providing nameservers that return different information than external ones.

Long shot, do you have a koji.conf in any of:

• /etc/koji.conf
• /etc/koji.conf.d/*.conf
• ~/.koji/config.d/*.conf

with different settings?

You mentioned brew, are you using koji or brew? (I know they are likey the same thing, but I wonder if there's a config difference calling brew?)

/etc/koji.conf

yes, I have it and it comes from koji-1.20.1-1.fc32.noarch

/etc/koji.conf.d/*.conf

Yes, from fedora-packager-0.6.0.2-8.fc32.noarch

with different settings?

I didn't update any of those files, it's default config as it comes with the packages.

You mentioned brew, are you using koji or brew? (I know they are likey the same thing, but I wonder if there's a config difference calling brew?)

No, I don't have brewkoji package installed.

See #2063 for a discussion on improving this UX.

Also, "krb_rdns" is going away, see https://bugzilla.redhat.com/show_bug.cgi?id=1812702

I see this message now if that makes any difference:

/usr/lib/python3.8/site-packages/koji/util.py:53: DeprecationWarning: Please use gssapi_login instead, krb_login will be removed in koji 1.22
warnings.warn(message, DeprecationWarning)

Yeah, thats a rpkg bug: https://pagure.io/rpkg/issue/498

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/1883

Please continue any further discussion there.