I don't think it is related to authentication. It seems to fail even connect to the hub on SSL port. Is the hub really running, can you run curl https://koji.linx.com/kojihub/ssllogin? It should return 401 unauthorized page if it works. Other possibility is some firewall issue (I can't even resolve koji.linx.com).

I don't think it is related to authentication. It seems to fail even connect to the hub on SSL port. Is the hub really running, can you run curl https://koji.linx.com/kojihub/ssllogin? It should return 401 unauthorized page if it works. Other possibility is some firewall issue (I can't even resolve koji.linx.com).

curl http://koji.linx.com/kojihub/ssllogin/

Unauthorized

This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.

curl https://koji.linx.com/kojihub/ssllogin/

curl: (7) Failed to connect to koji.linx.com port 443 after 0 ms: Connection refused

It return 401. It is deployed on private server nodes, and firewall is closed.

It seems that https is not set up correctly? Maybe commented-out https://pagure.io/koji/blob/master/f/kojihub/app/httpd.conf#_51 ?

It seems that https is not set up correctly? Maybe commented-out https://pagure.io/koji/blob/master/f/kojihub/app/httpd.conf#_51 ?

It's the same fit as mine, except that lines 52-57 are uncommented.

I'm assuming this auth error is coming from a cli command and that you have a valid krb ticket.

On technique that is sometimes helpful to debug auth is to perform the equivalent calls with curl.

First, verify that the connection works without auth. E.g.

$ curl  --data "<?xml version='1.0'?><methodCall><methodName>hello</methodName><params></params></methodCall>" https://koji.fedoraproject.org/kojihub
<?xml version='1.0'?>
<methodResponse>
<params>
<param>
<value><string>Hello World</string></value>
</param>
</params>
</methodResponse>

If this first step doesn't work, then your problem is probably deeper than auth.

Assuming basic connection works, then you could try to simulate a login. E.g.

$ curl --negotiate -u : --data "<?xml version='1.0'?><methodCall><methodName>sslLogin</methodName><params></params></methodCall>" https://koji.fedoraproject.org/kojihub/ssllogin
<?xml version='1.0'?>
<methodResponse>
-snip- REDACTED
</methodResponse>

Please note that the above command will display a session key if successful. Do not expose this secret data.

If this second command fails, then you've replicated the auth issue without using the koji client. For further digging, you could try running it with KRB5_TRACE=/dev/stdout

Note that trying to access kojihub/ssllogin with curl without passing --negotiate, as you appear to be doing in an above comment, will certainly result in a 401 because curl will not by default provide any credentials.

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/4077

Please continue any further discussion there.