koji

#237 krb_login hangs
Closed: Invalid Opened by cqi.

Closed: Invalid
Reopen Issue

koji-1.11.0-1.fc24.noarch

I'm building fedpkg packages, ClientSession.krb_login hangs fedpkg. I track it step by step and see

...
> /usr/lib/python2.7/site-packages/koji/__init__.py(2049)krb_login()
-> if self.gssapi_login(proxyuser=proxyuser):
(Pdb) n
UnboundLocalError: "local variable 'sinfo' referenced before assignment"
...
> /usr/lib/python2.7/site-packages/koji/__init__.py(2091)krb_login()
-> (rep_enc, sinfo_enc, addrinfo) = self.callMethod('krbLogin', req_enc, proxyuser)
(Pdb) n

krb_login hangs at line of calling self.callMethod finally.

My ccache

klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: cqi@FEDORAPROJECT.ORG
Valid starting       Expires              Service principal
12/12/2016 16:22:46  12/13/2016 02:22:39  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
12/12/2016 16:39:32  12/13/2016 02:22:39  HTTP/proxy01.fedoraproject.org@FEDORAPROJECT.ORG
12/12/2016 19:53:14  12/13/2016 02:22:39  host/koji.fedoraproject.org@FEDORAPROJECT.ORG
12/12/2016 19:56:16  12/13/2016 02:22:39  HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG

I also run koji hello, and get

$ KRB5_TRACE=/dev/stdout koji hello
[9151] 1481545951.686316: Getting credentials cqi@FEDORAPROJECT.ORG -> host/proxy10.fedoraproject.org@FEDORAPROJECT.ORG using ccache FILE:/tmp/krb5
cc_1000
[9151] 1481545951.686457: Retrieving cqi@FEDORAPROJECT.ORG -> host/proxy10.fedoraproject.org@FEDORAPROJECT.ORG from FILE:/tmp/krb5cc_1000 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[9151] 1481545951.686538: Retrieving cqi@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from FILE:/tmp/krb5cc_1000 with result: 0/Success
[9151] 1481545951.686549: Starting with TGT for client realm: cqi@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
[9151] 1481545951.686559: Requesting tickets for host/proxy10.fedoraproject.org@FEDORAPROJECT.ORG, referrals on
[9151] 1481545951.686612: Generated subkey for TGS request: aes256-cts/3E3A
[9151] 1481545951.686654: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[9151] 1481545951.686721: Encoding request body and padata into FAST request
[9151] 1481545951.686780: Sending request (966 bytes) to FEDORAPROJECT.ORG
[9151] 1481545951.686972: Resolving hostname id.fedoraproject.org
[9151] 1481545952.897272: TLS certificate name matched "id.fedoraproject.org"
[9151] 1481545953.306123: Sending HTTPS request to https 185.141.165.254:443
[9151] 1481545953.614018: TLS certificate name matched "id.fedoraproject.org"
[9151] 1481545953.861847: Sending HTTPS request to https 67.219.144.68:443
[9151] 1481545954.295907: Received answer (508 bytes) from https 185.141.165.254:443
[9151] 1481545954.295940: Terminating TCP connection to https 185.141.165.254:443
[9151] 1481545954.298077: Terminating TCP connection to https 67.219.144.68:443
[9151] 1481545954.300788: Terminating TCP connection to https 209.132.181.15:443
[9151] 1481545954.302746: Response was not from master KDC
[9151] 1481545954.302881: Decoding FAST response
[9151] 1481545954.302965: TGS request result: -1765328370/KDC has no support for encryption type
[9151] 1481545954.302980: Requesting tickets for host/proxy10.fedoraproject.org@FEDORAPROJECT.ORG, referrals off
[9151] 1481545954.303121: Generated subkey for TGS request: aes256-cts/021A
[9151] 1481545954.303183: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[9151] 1481545954.303346: Encoding request body and padata into FAST request
[9151] 1481545954.306218: Sending request (966 bytes) to FEDORAPROJECT.ORG
[9151] 1481545954.306297: Resolving hostname id.fedoraproject.org
[9151] 1481545954.841726: TLS certificate name matched "id.fedoraproject.org"
[9151] 1481545955.149226: Sending HTTPS request to https 67.219.144.68:443
[9151] 1481545955.660165: Received answer (510 bytes) from https 67.219.144.68:443
[9151] 1481545955.660182: Terminating TCP connection to https 67.219.144.68:443
[9151] 1481545955.661355: Terminating TCP connection to https 209.132.181.15:443
[9151] 1481545955.662270: Response was not from master KDC
[9151] 1481545955.662332: Decoding FAST response
[9151] 1481545955.662366: TGS request result: -1765328370/KDC has no support for encryption type
Kerberos authentication failed: KDC has no support for encryption type (-1765328370)

cc: @puiterwijk

@cqi -- what settings are you using for that session? Is krb_login hanging when you run the koji command, or when run through some other command? What does "koji --noauth hello" say? What happens if you run with --debug?
Edited by mikem

fwiw, works here:

[mike@localhost ~]$ rpm -q koji
koji-1.11.0-1.fc24.noarch
[mike@localhost ~]$ kinit mikem@FEDORAPROJECT.ORG
Password for mikem@FEDORAPROJECT.ORG:
[mike@localhost ~]$ python
Python 2.7.12 (default, Sep 29 2016, 13:30:34)
[GCC 6.2.1 20160916 (Red Hat 6.2.1-2)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import koji
>>> s = koji.ClientSession('https://koji.fedoraproject.org/kojihub')
>>> s.krb_login()
True

For Fedora's setup, you need krb_rdns=false.
Given that it says "Requesting tickets for host/proxy10.fedoraproject.org@FEDORAPROJECT.ORG", I know that that setting is NOT being used/set correctly.

If krb_rdns=false, it will use host/koji.fedoraproject.org@FEDORAPROJECT.ORG

Fixed. /etc/koji.conf is not replaced with the new one in my machine. After renaming /etc/koji.conf.rpmnew,

koji hello
bonjour, cqi!
You are using the hub at https://koji.fedoraproject.org/kojihub
Authenticated via Kerberos principal cqi@FEDORAPROJECT.ORG

Thanks @mikem and @puiterwijk for your help. This issue can be closed.

@mikem changed the status to Closed

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/237

Please continue any further discussion there.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.