LGTM from the first glance.

Any ideas why it might not work?

20/04/15 16:12:25 rack-na/koji, Infrastructure NA1 INTGDC (id 801)
[root@koji:~] koji --keytab /etc/krb5.keytab --principal host/koji.int.na.intgdc.com@INTGDC.COM hello
bună ziua, host/koji.int.na.intgdc.com!
You are using the hub at https://koji.intgdc.com/kojihub
Authenticated via GSSAPI
20/04/15 16:12:28 rack-na/koji, Infrastructure NA1 INTGDC (id 801)
[root@koji:~] koji-gc --keytab /etc/krb5.keytab --principal host/koji.int.na.intgdc.com@INTGDC.COM --purge -n
Traceback (most recent call last):
  File "/sbin/koji-gc", line 936, in <module>
    rv = main(args)
  File "/sbin/koji-gc", line 402, in main
    activate_session(session)
  File "/sbin/koji-gc", line 351, in activate_session
    session.krb_login(principal=options.principal, keytab=options.keytab, proxyuser=options.runas)
  File "/usr/lib/python2.7/site-packages/koji/__init__.py", line 2310, in krb_login
    if self.gssapi_login(principal, keytab, ccache, proxyuser=proxyuser):
  File "/usr/lib/python2.7/site-packages/koji/__init__.py", line 2467, in gssapi_login
    raise AuthError('unable to obtain a session')
koji.AuthError: unable to obtain a session

Hmm, I'm not able to reproduce it. Can you try debug mode (-d)? Or

KRB5_TRACE=/dev/stdout koji-gc --keytab /etc/krb5.keytab --principal host/koji.int.na.intgdc.com@INTGDC.COM -n

[16208] 1587033759.561401: Requesting TGT krbtgt/FEDORAPROJECT.ORG@INTGDC.COM using TGT krbtgt/INTGDC.COM@INTGDC.COM

Hmm, why does it use FEDORAPROJECT,ORG there?

Ugh, just realized that gc.conf had wrong hub URL.

This PR looks good!

@tkopecek just one thing, koji does not seem to create trashcan tag by default...

No, we don't create it. Some people are not using kojira at all, so such tag doesn't make any sense for them. But we should emphasize it in kojira docs.

Hmm, is koji-gc automatically called from kojira?

ouch, s/kojira/koji-gc/g

When the service first starts up, we could add some pre-flight checks to make this easier for new users:

• Verify that the user account has the correct permissions
• Ensure the "trashcan" tag exists

And if these pre-flight checks fail, immediately stop the daemon with a human-readable error message that describes the problem and the remedy.

I've tested this PR, and koji-gc can successfully authenticate with a keytab in my environment.

:thumbsup: I've created #2190 for trashcan tag and extended #2189 for permission check (it is not that easy as koji-gc requires more permissions than just the admin one).

@tkopecek do we still want to krbV in koji-utils? as https://pagure.io/koji/issue/1906 has been applied to cli

@julian8628 Makes sense, let's drop it from here.

Commit 8f2d02c3 fixes this pull-request

I've tested this in a Kerberos environment and koji-gc can authenticate and run without error.