koji

#708 Implement support for keytab in gssapi codepaths
Merged by mikem. Opened by puiterwijk.
puiterwijk/koji py3-keytab  into  master

Download 708.patch

This had been a TODO that until now wasn't critical since python2 would fall back to krbV.
For python3, we only have gssapi, so implement keytabs and ccache for gssapi.

Signed-off-by: Patrick Uiterwijk patrick@puiterwijk.org

Thanks for this, looks good at a glance. I'll play with it some tomorrow.

Any concerns about different versions of python-requests-kerberos?

The principal argument has been supported since python-requests-kerberos 0.9.0, released on May 6, 2016. The rest of the stuff is handled by krb5-libs.
Edited by puiterwijk

rebased onto 6157651bb64d910a272112374871d8aa6b1102be

Unfortunately, I can't fully test this myself since I don't have keytabs for a gssapi enabled koji instance. However, it seems to be sane and not break the existing auth.

A few things though...

  1. As long as we're here, we should get rid of the bare exception handlers.
  2. The code for restoring os.environ doesn't work. It looks like doing this properly might be a bit messing since os.environ is an odd type.
  3. We're trying to add unit tests as we go. In the process of reviewing this, I've written a few.
  4. The try..finally for resetting the environ should probably cover a wider span in case there is an error earlier.

I've addressed some of this here:
https://github.com/mikem23/koji-playground/commits/pagure/pr/708

This includes a unit test that is currently failing because the environ reset isn't working.

rebased onto 6bfef6cc1b0ef8165481d0005535804bc3bb44ce

Hi, thanks for those fixes.
I've pushed a new changeset to this PR, which includes your commits, and fixes the environment resetting, making the gssapi tests pass.

6 new commits added

  • Fix resetting the environment
  • unit tests for gssapi auth
  • fix another bare exception
  • be a little more paranoid about undoing opts/environ mangling
  • avoid bare exception and add some debug logging
  • Implement support for keytab in gssapi codepaths

whoops, one of my commits used old exception syntax. Fixed here:
https://github.com/mikem23/koji-playground/commits/pagure/pr/708

1 new commit added

  • fix exception syntax

Commit b320d2f1 fixes this pull-request

Pull-Request has been merged by mikem
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.