This patch set allows you to set the entire Kerberos principal for the Koji hub. When using Kerberos in an Active Directory environment, the server principal is not the typical host/server@REALM format, but rather HOSTNAME$. The existing configuration for the hub is not sufficient as you can only define the service, not the entire principal.
Aron Parsons (3): add a fallback to an unformatted version of host_principal_format allow the hub server principal to be defined add support for defining HubPrincipal in koji-gc
builder/kojid | 5 ++++- koji/__init__.py | 19 +++++++++++-------- util/koji-gc | 5 ++++- www/kojiweb/index.py | 3 ++- www/kojiweb/wsgi_publisher.py | 1 + 5 files changed, 22 insertions(+), 11 deletions(-)
If the host_principal_format does not contain any strings to format, fallback to an unformatted version of the string instead of raising an exception. --- builder/kojid | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/builder/kojid b/builder/kojid index 23ac5dc..c80894e 100755 --- a/builder/kojid +++ b/builder/kojid @@ -3204,7 +3204,10 @@ if __name__ == "__main__": elif sys.modules.has_key('krbV'): krb_principal = options.krb_principal if krb_principal is None: - krb_principal = options.host_principal_format % socket.getfqdn() + try: + krb_principal = options.host_principal_format % socket.getfqdn() + except TypeError: + krb_principal = options.host_principal_format try: session.krb_login(principal=krb_principal, keytab=options.keytab,
When using Kerberos in an Active Directory environment, the server principal is not the typical host/server@REALM format, but rather HOSTNAME$. Allow the hub principal to be defined in the conf file, but fallback to the old behavior if it's not present. --- koji/__init__.py | 19 +++++++++++-------- www/kojiweb/index.py | 3 ++- www/kojiweb/wsgi_publisher.py | 1 + 3 files changed, 14 insertions(+), 9 deletions(-)
diff --git a/koji/__init__.py b/koji/__init__.py index 81be227..58a4880 100644 --- a/koji/__init__.py +++ b/koji/__init__.py @@ -1699,14 +1699,17 @@ class ClientSession(object): def _serverPrincipal(self, cprinc): """Get the Kerberos principal of the server we're connecting to, based on baseurl.""" - servername = self._host - #portspec = servername.find(':') - #if portspec != -1: - # servername = servername[:portspec] - realm = cprinc.realm - service = self.opts.get('krbservice', 'host') - - return '%s/%s@%s' % (service, servername, realm) + if self.opts.get('hubprincipal', None): + return self.opts.get('hubprincipal', None) + else: + servername = self._host + #portspec = servername.find(':') + #if portspec != -1: + # servername = servername[:portspec] + realm = cprinc.realm + service = self.opts.get('krbservice', 'host') + + return '%s/%s@%s' % (service, servername, realm)
def ssl_login(self, cert, ca, serverca, proxyuser=None): certs = {} diff --git a/www/kojiweb/index.py b/www/kojiweb/index.py index 0505c9c..f13afd2 100644 --- a/www/kojiweb/index.py +++ b/www/kojiweb/index.py @@ -158,7 +158,8 @@ def _assertLogin(environ): def _getServer(environ): opts = environ['koji.options'] session = koji.ClientSession(opts['KojiHubURL'], - opts={'krbservice': opts['KrbService']}) + opts={'krbservice': opts['KrbService'], + 'hubprincipal': opts['HubPrincipal']})
environ['koji.currentLogin'] = _getUserCookie(environ) if environ['koji.currentLogin']: diff --git a/www/kojiweb/wsgi_publisher.py b/www/kojiweb/wsgi_publisher.py index 3f7a5a5..d269db4 100644 --- a/www/kojiweb/wsgi_publisher.py +++ b/www/kojiweb/wsgi_publisher.py @@ -70,6 +70,7 @@ class Dispatcher(object): ['KojiTheme', 'string', None], ['KojiGreeting', 'string', 'Welcome to Koji Web'],
+ ['HubPrincipal', 'string', None], ['WebPrincipal', 'string', None], ['WebKeytab', 'string', '/etc/httpd.keytab'], ['WebCCache', 'string', '/var/tmp/kojiweb.ccache'],
--- util/koji-gc | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-)
diff --git a/util/koji-gc b/util/koji-gc index 424b0fb..9f4012d 100755 --- a/util/koji-gc +++ b/util/koji-gc @@ -81,6 +81,8 @@ def get_options(): parser.add_option("--principal", help=_("specify a Kerberos principal to use")) parser.add_option("--krbservice", default="host", help=_("the service name of the principal being used by the hub")) + parser.add_option("--hubprincipal", default="host", + help=_("specify the Kerberos principal the hub uses")) parser.add_option("--runas", metavar="USER", help=_("run as the specified user (requires special privileges)")) parser.add_option("--user", help=_("specify user")) @@ -159,6 +161,7 @@ def get_options(): cfgmap = [ ['keytab', None, 'string'], ['principal', None, 'string'], + ['hubprincipal', None, 'string'], ['krbservice', None, 'string'], ['runas', None, 'string'], ['user', None, 'string'], @@ -927,7 +930,7 @@ if __name__ == "__main__": options, args = get_options()
session_opts = {} - for k in ('user', 'password', 'krbservice', 'email_domain', 'debug_xmlrpc', 'debug'): + for k in ('user', 'password', 'krbservice', 'email_domain', 'debug_xmlrpc', 'debug', 'hubprincipal'): session_opts[k] = getattr(options,k) if options.network_hack: socket.setdefaulttimeout(180)
buildsys@lists.fedoraproject.org
-
Aron Parsons