From e87c11241d3204d94fbfd58b5fb3282347d16d08 Mon Sep 17 00:00:00 2001
From: Tomas Kopecek <tkopecek@redhat.com>
Date: Apr 15 2020 11:39:24 +0000
Subject: [PATCH 1/2] koji-gc: support request_kerberos


Fixes: https://pagure.io/koji/issue/2143

---

diff --git a/util/koji-gc b/util/koji-gc
index eafc13c..4cc3a4d 100755
--- a/util/koji-gc
+++ b/util/koji-gc
@@ -30,11 +30,6 @@ import koji
 import koji.policy
 from koji.util import LazyDict, LazyValue, to_list
 
-try:
-    import krbV
-except ImportError:  # pragma: no cover
-    krbV = None
-
 
 def _(args):
     """Stub function for translation"""
@@ -368,18 +363,6 @@ def ensure_connection(session):
                (ret, koji.API_VERSION)))
 
 
-def has_krb_creds():
-    if krbV is None:
-        return False
-    try:
-        ctx = krbV.default_context()
-        ccache = ctx.default_ccache()
-        ccache.principal()
-        return True
-    except krbV.Krb5Error:
-        return False
-
-
 def activate_session(session):
     """Test and login the session is applicable"""
     global options
@@ -392,17 +375,9 @@ def activate_session(session):
     elif options.user:
         # authenticate using user/password
         session.login()
-    elif has_krb_creds() or (options.keytab and options.principal):
-        try:
-            if options.keytab and options.principal:
-                session.krb_login(principal=options.principal, keytab=options.keytab,
-                                  proxyuser=options.runas)
-            else:
-                session.krb_login(proxyuser=options.runas)
-        except krbV.Krb5Error as e:
-            error(_("Kerberos authentication failed: %s (%s)") % (e.args[1], e.args[0]))
-        except socket.error as e:
-            warn(_("Could not connect to Kerberos authentication service: '%s'") % e.args[1])
+    elif koji.krbV or koji.requests_kerberos:
+        session.krb_login(principal=options.principal, keytab=options.keytab,
+                          proxyuser=options.runas)
     if not options.noauth and not session.logged_in:
         error(_("Error: unable to log in, no authentication methods available"))
     ensure_connection(session)

From d668e7a95e9ea313415a51ef3bc94e13465681ed Mon Sep 17 00:00:00 2001
From: Tomas Kopecek <tkopecek@redhat.com>
Date: May 06 2020 13:40:13 +0000
Subject: [PATCH 2/2] replace krb_login with gssapi_login


---

diff --git a/util/koji-gc b/util/koji-gc
index 4cc3a4d..101f1d5 100755
--- a/util/koji-gc
+++ b/util/koji-gc
@@ -46,14 +46,6 @@ def get_options():
                       help=_("use alternate configuration file"))
     parser.add_option("--keytab", help=_("specify a Kerberos keytab to use"))
     parser.add_option("--principal", help=_("specify a Kerberos principal to use"))
-    parser.add_option("--krbservice", default="host",
-                      help=_("the service name of the principal being used by the hub"))
-    parser.add_option("--krb-rdns", action="store_true", default=False,
-                      help=_("get reverse dns FQDN for krb target"))
-    parser.add_option("--krb-canon-host", action="store_true", default=False,
-                      help=_("get canonical hostname for krb target"))
-    parser.add_option("--krb-server-realm",
-                      help=_("the realm of server Kerberos principal"))
     parser.add_option("--runas", metavar="USER",
                       help=_("run as the specified user (requires special privileges)"))
     parser.add_option("--user", help=_("specify user"))
@@ -132,10 +124,6 @@ def get_options():
         # name, alias, type
         ['keytab', None, 'string'],
         ['principal', None, 'string'],
-        ['krbservice', None, 'string'],
-        ['krb_rdns', None, 'boolean'],
-        ['krb_canon_host', None, 'boolean'],
-        ['krb_server_realm', None, 'string'],
         ['runas', None, 'string'],
         ['user', None, 'string'],
         ['password', None, 'string'],
@@ -375,8 +363,8 @@ def activate_session(session):
     elif options.user:
         # authenticate using user/password
         session.login()
-    elif koji.krbV or koji.requests_kerberos:
-        session.krb_login(principal=options.principal, keytab=options.keytab,
+    elif koji.requests_kerberos:
+        session.gssapi_login(principal=options.principal, keytab=options.keytab,
                           proxyuser=options.runas)
     if not options.noauth and not session.logged_in:
         error(_("Error: unable to log in, no authentication methods available"))