We have a keytab, but we'll have to use the keytab to get the ticket granting ticket, and we'll have to use the ticket granting ticket to get a new ticket.

But the ticket granting ticket is only valid for a day, so while rida's backend is running it will need to know how to renew its tickets, etc.. Non-trivial.

Ask @puiterwijk, he has some handy examples around for how to manage this.

The keytab for the dev instance is in ~/modularity.keytab.

We'll need to support both the "production" usage (using a keytab) as well as the "development" usage where the developer is running rida locally - they won't have a keytab, but rida will just have to re-use their krb tickets.

Module Build Service stopped working today, because SSL auth has been removed from Koji staging. I persuaded puiterwijk on #fedora-admin to get us more time to port, so SSL auth is enabled again, but we should fix it next week definitely.

Commit 70ec4b36 relates to this ticket

Supposedly, this is done. We have a way to use krb auth in our dev containers, we have the keytab on the dev node, and the code as written should support it.

We can't quite test it yet because it seems that krb auth is generally broken with stg koji at the moment. Will return to this soon.

It works!

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/koji/mbs/issues/111

Please continue any further discussion there.