waiverdb

#346 Add krb_principal option for waiverdb-cli
Merged by lholecek. Opened by lholecek.
lholecek/waiverdb krb_dns_canonicalize_hostname  into  master

Download 346.patch

By default Kerberos tries to use FQDN of the server. E.g. if client.conf
contains:

[waiverdb]
auth_method=Kerberos
api_url=https://waiverdb.example.com/api/v1.0

And FQDN of "waiverdb.example.com" is "web-waiverdb.app.os.example.com"
the Kerberos principal will be
"HTTP/web-waiverdb.app.os.example.com@EXAMPLE.COM" which may not match
the principal in server's keytab.

This can be changed by using different configuration file with
dns_canonicalize_hostname=false setting and setting path to the file
using KRB5_CONFIG environment variable.

The new option krb_principal allows to override the Kerberos principal
in waiverdb-cli configuration file instead. E.g:

[waiverdb]
auth_method=Kerberos
api_url=https://waiverdb.example.com/api/v1.0
krb_principal=HTTP/waiverdb.example.com@EXAMPLE.COM

Signed-off-by: Lukas Holecek hluk@email.cz

Hmm, I need to get rid of the REDHAT.COM.

rebased onto beea54df9238d5c824cc671de35505624c64948c

Hmm, I need to get rid of the REDHAT.COM.

Done. :)

There is probably a better way to do all this automatically - i.e. if krb authentication fails, retry with krb principal constructed from the original host name (constructed the same way as if we had dns_canonicalize_hostname=false in krb5.conf).

should we change also our internal conf once this is merged with this parameter?

Looks good! +1

should we change also our internal conf once this is merged with this parameter?

I don't know if we have any. But we should update internal documentation for the kerberos setup for waiverdb-cli.

should we change also our internal conf once this is merged with this parameter?

I don't know if we have any. But we should update internal documentation for the kerberos setup for waiverdb-cli.

We already have that: https://mojo.redhat.com/docs/DOC-1166445

I'll update the documentation after this is merged. I can mention the new option and that the kerberos setup won't be needed after waiverdb-cli version 1.1.2.

sounds good!

@mprahl, @yashn Can you help review this?

rebased onto 5ca2b7939e4092c534250378862f7d338d557c86

Pull-Request has been merged by lholecek
Metadata
None
No Tags
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.