From 1ab359169dfd35e3af71be983356e48bba9e0989 Mon Sep 17 00:00:00 2001
From: Tomas Kopecek <tkopecek@redhat.com>
Date: Jan 16 2017 15:58:08 +0000
Subject: Don't try gssapi if krb is explicitly requested


---

diff --git a/cli/koji b/cli/koji
index d1d70c5..69e6fbf 100755
--- a/cli/koji
+++ b/cli/koji
@@ -7214,11 +7214,12 @@ def activate_session(session):
         # authenticate using user/password
         session.login()
     elif options.authtype == "kerberos" or has_krb_creds() and options.authtype is None:
+        force_krb = options.authtype == "kerberos"
         try:
             if options.keytab and options.principal:
-                session.krb_login(principal=options.principal, keytab=options.keytab, proxyuser=options.runas)
+                session.krb_login(principal=options.principal, keytab=options.keytab, proxyuser=options.runas, force_krb=force_krb)
             else:
-                session.krb_login(proxyuser=options.runas)
+                session.krb_login(proxyuser=options.runas, force_krb=force_krb)
         except krbV.Krb5Error, e:
             error(_("Kerberos authentication failed: %s (%s)") % (e.args[1], e.args[0]))
         except socket.error, e:
diff --git a/koji/__init__.py b/koji/__init__.py
index ed57965..8ed1b29 100644
--- a/koji/__init__.py
+++ b/koji/__init__.py
@@ -2033,7 +2033,7 @@ class ClientSession(object):
         sinfo = self.callMethod('subsession')
         return type(self)(self.baseurl, self.opts, sinfo)
 
-    def krb_login(self, principal=None, keytab=None, ccache=None, proxyuser=None):
+    def krb_login(self, principal=None, keytab=None, ccache=None, proxyuser=None, force_krb=False):
         """Log in using Kerberos.  If principal is not None and keytab is
         not None, then get credentials for the given principal from the given keytab.
         If both are None, authenticate using existing local credentials (as obtained
@@ -2041,11 +2041,13 @@ class ClientSession(object):
         not specified, the default ccache will be used.  If proxyuser is specified,
         log in the given user instead of the user associated with the Kerberos
         principal.  The principal must be in the "ProxyPrincipals" list on
-        the server side."""
+        the server side.
+        If force_krb is not true, gssapi is tried first.
+        """
 
-        if principal is None and keytab is None and ccache is None:
+        if not force_krb and principal is None and keytab is None and ccache is None:
             try:
-                # Silently try GSSAPI first
+                # Silently try GSSAPI first if krb is not forced
                 if self.gssapi_login(proxyuser=proxyuser):
                     return True
             except: