Looks good to me.

This will mean we can drop load_user method in rhpkg. For fedpkg we want to keep it as it also gets the name from certificate.

It fixes retrieving username when user has multiple kerberos tickets. Rhpkg currently only looks at the primary ticket. This package looks for the correct realm.

LGTM

rpkg has another method _has_krb_creds to detect if credential cache is initialized, that uses gssapi and will fallback to krbV if gssapi is not available in RHEL. It works but not good enough, as there are two dependencies to deal with one thing.

When I see cccolutils, I feel rpkg might have another better chance to deal with Kerberos stuff with one dependency. That is, if cccolutils is able to raise error, the krb5_error_code, when credential cache is not valid, it could be used to do the same thing mentioned above.

@lsedlar @puiterwijk what do you think?

Yes, that would be nice. It would simplify the dependencies a lot.

I can totally add that, sure. Will try to get the new release out today.

Hi @puiterwijk @lsedlar

It looks krb5 cache collection API is not a good place to check the availability of a credential cache, because it just iterates the collection to get each cache, but not acquire the cache. I'm afraid I need to correct my thoughts, including the comment of issue 1.

The current situation of supporting Kerberos in rpkg is

• cache collection has to be supported, to get user name from a matched principal by configured realms.
• the original simple file cache should be also supported, since not everyone uses cache collection.

So, python-gssapi, python-krbV and cccolutils would still be the necessary dependencies of rpkg. That is,

• in Fedora, only where python-gssapi is available, and it is used to detect whether current primary credential cache is valid (initialized and not expired). It's already done in rpkg now. Getting user name, the load_user, could be a two-steps operation

• first, assmume cache collection is used, then use cccolutils to find matched principal by configured realms

• if no matched principal, fall back to gssapi to get principal from simple file cache

• in EL6 and EL7, it's similar with Fedora, but have to use krbV instead.

Please correct me if anything I understand inaccurately. It's appreciated.