koji

#4142 Unable to login into koji-web via kerberos
Opened by frank-mdc. Modified

Open
Close Issue

Hello,
I have a really strange problem with the koji web service.
I can connect to the hub via the command line.
Kojira and the kojid can also log in via kerberos to the hub.
The only thing that doesn't work and where I don't see an error (even tcpdump didn't show anything unusual on the hub, web, nor on the kdc) is logging in to the web interface via kerberos. Neither with curl nor with a real browser does it work. There is no error in the apache log from the hub nor on the log in the kdc. The log from koji web always shows the following error:

[Fri Jul 26 08:22:05.129722 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] 129 [INFO] m=login u=None p=585368 r=:49382 koji.web: Method: login
[Fri Jul 26 08:22:05.130286 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] 130 [DEBUG] m=login u=None p=585368 r=:49382 koji: Opening new requests session
[Fri Jul 26 08:22:05.130601 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] 130 [DEBUG] m=login u=None p=585368 r=:49382 koji: Opening new requests session
[Fri Jul 26 08:22:05.159476 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] 159 [DEBUG] m=login u=None p=585368 r=:49382 koji: Opening new requests session
[Fri Jul 26 08:22:05.160009 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] 159 [ERROR] m=login u=None p=585368 r=:49382 koji: (gssapi auth failed: requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https:///kojihub/ssllogin)
[Fri Jul 26 08:22:05.160056 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] Use following documentation to debug kerberos/gssapi auth issues. https://docs.pagure.org/koji/kerberos_gssapi_debug/
[Fri Jul 26 08:22:05.160068 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382]
[Fri Jul 26 08:22:05.161506 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] 161 [ERROR] m=login u=None p=585368 r=:49382 koji.web: Traceback (most recent call last):
[Fri Jul 26 08:22:05.161532 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] File "/usr/share/koji-web/scripts/wsgi_publisher.py", line 389, in handle_request
[Fri Jul 26 08:22:05.161539 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] result = func(environ, **data)
[Fri Jul 26 08:22:05.161544 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] File "/usr/share/koji-web/scripts/index.py", line 310, in login
[Fri Jul 26 08:22:05.161548 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] if not _gssapiLogin(environ, session, username):
[Fri Jul 26 08:22:05.161553 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] File "/usr/share/koji-web/scripts/index.py", line 151, in _gssapiLogin
[Fri Jul 26 08:22:05.161558 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] ccache=ccache, proxyuser=principal, proxyauthtype=authtype)
[Fri Jul 26 08:22:05.161563 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] File "/usr/lib/python3.6/site-packages/koji/init.py", line 2800, in gssapi_login
[Fri Jul 26 08:22:05.161568 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] raise GSSAPIAuthError(err)
[Fri Jul 26 08:22:05.161573 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] koji.GSSAPIAuthError: unable to obtain a session (gssapi auth failed: requests.exceptions.HTTPError: 401 Client Error: Unauthorized for url: https:///kojihub/ssllogin)
[Fri Jul 26 08:22:05.161578 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382] Use following documentation to debug kerberos/gssapi auth issues. https://docs.pagure.org/koji/kerberos_gssapi_debug/
[Fri Jul 26 08:22:05.161586 2024] [wsgi:error] [pid 585368:tid 140276440688384] [remote:49382]

In the log of the KDC I can see, that the koji/kojiweb@ ticket was requested. The request comes from the koji-web service.

Thanks for any ideas.

In the web ui there are two layers of authentication.

  • between the user and the web ui
  • between the web ui and the hub

This traceback is from the web ui attempting to log in to the hub. If you've gotten this far, then the web ui has already accepted credentials from the user as valid. The problem is that the web ui's own credentials aren't being recognized by the hub, so the web is getting a 401 when it attempts to get a session.

First thing is to check that you've correctly configured your kerberos auth in web.conf.
Second thing is to check that the webui httpd process can actually read the configured files (e.g.perms/context on keytab).
Third thing is to test that the configured credentials actually work. I.e. try using them directly with curl to authenticate to the hub.

Metadata Update from @mikem:
- Custom field Size adjusted to None

Using curl I can log into the hub form the web itself:
kdestory
kinit koji/kojiweb@
KRB5_TRACE=/dev/stdout curl -vvvv --negotiate -u : https:///kojihub/ssllogin
Method Not Allowed
This is an XML-RPC server. Only POST requests are accepted

And the keytab file are readable by koji web. Because when I make it unreadable, I seen error about this.

On the hub also in the debug mode I don't see the kerberos stuff from the web.
I only see this line:
- - [02/Aug/2024:11:36:49 +0200] "POST /kojihub/ssllogin HTTP/1.1" 401 381
TLSv1.3 TLS_AES_128_GCM_SHA256 "POST /kojihub/ssllogin HTTP/1.1" 381

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/koji/issues/4142

Please continue any further discussion there.
Metadata
None
None
None
None
Low
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.