Hi,
I'm trying to use the --runas parameter and get the following error:
AuthError: /C=blah/ST=blah/O=blah/OU=blah/CN=<user>/emailAddress=blah is not authorized to login other users
The user that I'm trying to submit the build from is kojiadmin (with admin permissions).
The reason that I'd like this, is that I want to use a post-commit trigger to submit a build using the kojiadmin user, but still submitting the build as the user that committed the change to SVN.
In auth.py:364 I see some mention of a proxyuser, but I don't know how to use it.
Can anyone help?
Regards,
Greg
On 04/20/2010 09:24 AM, Greg Trahair wrote:
Hi,
I'm trying to use the --runas parameter and get the following error:
AuthError: /C=blah/ST=blah/O=blah/OU=blah/CN=<user>/emailAddress=blah is not authorized to login other users
The user that I'm trying to submit the build from is kojiadmin (with admin permissions).
The reason that I'd like this, is that I want to use a post-commit trigger to submit a build using the kojiadmin user, but still submitting the build as the user that committed the change to SVN.
In auth.py:364 I see some mention of a proxyuser, but I don't know how to use it.
Can anyone help?
If you're using SSL auth, you need to put the full DN of the client certificate you're logging in with (the DN is printed in the AuthError) into the ProxyDN= config entry in hub.conf. This establishes that the client using that DN is authorized to log in as another user.
Hi Mike,
Thanks for the response. This indeed worked like a charm, although, it didn't seem to work in hub.conf, but in the python options.
I plan to try again today to get it working in hub.conf, but here's what I had (obviously the .. are values on my system:
hub.conf (didn't work): ProxyDNs = /C=.../ST=.../O=.../OU=.../CN=.../emailAddress=...@... | /C=.../ST=.../O=.../OU=.../CN=.../emailAddress=...
pythonOptions (worked): PythonOption ProxyDNs "/C=.../ST=.../O=.../OU=.../CN=.../emailAddress=...|/C=.../ST=.../O=.../ OU=.../CN=.../emailAddress=..."
Can you give me an example of a working hub.conf with multiple builders?
Regards, Greg
-----Original Message----- From: buildsys-bounces@lists.fedoraproject.org [mailto:buildsys-bounces@lists.fedoraproject.org] On Behalf Of Mike Bonnet Sent: Tuesday, April 20, 2010 5:33 PM To: Discussion of Fedora build system Subject: Re: Koji special permissions for --runas
On 04/20/2010 09:24 AM, Greg Trahair wrote:
Hi,
I'm trying to use the --runas parameter and get the following error:
AuthError: /C=blah/ST=blah/O=blah/OU=blah/CN=<user>/emailAddress=blah
is
not authorized to login other users
The user that I'm trying to submit the build from is kojiadmin (with admin permissions).
The reason that I'd like this, is that I want to use a post-commit trigger to submit a build using the kojiadmin user, but still
submitting
the build as the user that committed the change to SVN.
In auth.py:364 I see some mention of a proxyuser, but I don't know how to use it.
Can anyone help?
If you're using SSL auth, you need to put the full DN of the client certificate you're logging in with (the DN is printed in the AuthError) into the ProxyDN= config entry in hub.conf. This establishes that the client using that DN is authorized to log in as another user. -- buildsys mailing list buildsys@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/buildsys
On 04/21/2010 04:09 AM, Greg Trahair wrote:
Hi Mike,
Thanks for the response. This indeed worked like a charm, although, it didn't seem to work in hub.conf, but in the python options.
I plan to try again today to get it working in hub.conf, but here's what I had (obviously the .. are values on my system:
hub.conf (didn't work): ProxyDNs = /C=.../ST=.../O=.../OU=.../CN=.../emailAddress=...@... | /C=.../ST=.../O=.../OU=.../CN=.../emailAddress=...
pythonOptions (worked): PythonOption ProxyDNs "/C=.../ST=.../O=.../OU=.../CN=.../emailAddress=...|/C=.../ST=.../O=.../ OU=.../CN=.../emailAddress=..."
Can you give me an example of a working hub.conf with multiple builders?
You shouldn't need to add builders to ProxyDNs, you should be creating a different certificate for each builder with a different CN, which will be used as the unique username. ProxyDNs is really only designed to allow the web UI perform actions as other users.
Is there a reason you need to add builders to ProxyDNs?
Regards, Greg
-----Original Message----- From: buildsys-bounces@lists.fedoraproject.org [mailto:buildsys-bounces@lists.fedoraproject.org] On Behalf Of Mike Bonnet Sent: Tuesday, April 20, 2010 5:33 PM To: Discussion of Fedora build system Subject: Re: Koji special permissions for --runas
On 04/20/2010 09:24 AM, Greg Trahair wrote:
Hi,
I'm trying to use the --runas parameter and get the following error:
AuthError: /C=blah/ST=blah/O=blah/OU=blah/CN=<user>/emailAddress=blah
is
not authorized to login other users
The user that I'm trying to submit the build from is kojiadmin (with admin permissions).
The reason that I'd like this, is that I want to use a post-commit trigger to submit a build using the kojiadmin user, but still
submitting
the build as the user that committed the change to SVN.
In auth.py:364 I see some mention of a proxyuser, but I don't know how to use it.
Can anyone help?
If you're using SSL auth, you need to put the full DN of the client certificate you're logging in with (the DN is printed in the AuthError) into the ProxyDN= config entry in hub.conf. This establishes that the client using that DN is authorized to log in as another user. -- buildsys mailing list buildsys@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/buildsys -- buildsys mailing list buildsys@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/buildsys
I used the wrong terminology :-(
I'm creating a svn post-commit hook that will automatically submit a build if a .spec file has been altered, but I still want the build to be submitted by the user that committed the change to the specfile. I've got it working fine by using the pythonOptions in /etc/httpd/conf.d/kojihub.conf, but it doesn't work if I put the same line (excluding the "'s) in /etc/koji-hub/hub.conf.
I was wondering if you have an example of the hub.conf with multiple proxyDN extries?
-----Original Message----- From: buildsys-bounces@lists.fedoraproject.org [mailto:buildsys-bounces@lists.fedoraproject.org] On Behalf Of Mike Bonnet Sent: Wednesday, April 21, 2010 3:18 PM To: Discussion of Fedora build system Subject: Re: Koji special permissions for --runas
On 04/21/2010 04:09 AM, Greg Trahair wrote:
Hi Mike,
Thanks for the response. This indeed worked like a charm, although,
it
didn't seem to work in hub.conf, but in the python options.
I plan to try again today to get it working in hub.conf, but here's
what
I had (obviously the .. are values on my system:
hub.conf (didn't work): ProxyDNs = /C=.../ST=.../O=.../OU=.../CN=.../emailAddress=...@... | /C=.../ST=.../O=.../OU=.../CN=.../emailAddress=...
pythonOptions (worked): PythonOption ProxyDNs
"/C=.../ST=.../O=.../OU=.../CN=.../emailAddress=...|/C=.../ST=.../O=.../
OU=.../CN=.../emailAddress=..."
Can you give me an example of a working hub.conf with multiple
builders?
You shouldn't need to add builders to ProxyDNs, you should be creating a different certificate for each builder with a different CN, which will be used as the unique username. ProxyDNs is really only designed to allow the web UI perform actions as other users.
Is there a reason you need to add builders to ProxyDNs?
Regards, Greg
-----Original Message----- From: buildsys-bounces@lists.fedoraproject.org [mailto:buildsys-bounces@lists.fedoraproject.org] On Behalf Of Mike Bonnet Sent: Tuesday, April 20, 2010 5:33 PM To: Discussion of Fedora build system Subject: Re: Koji special permissions for --runas
On 04/20/2010 09:24 AM, Greg Trahair wrote:
Hi,
I'm trying to use the --runas parameter and get the following error:
AuthError: /C=blah/ST=blah/O=blah/OU=blah/CN=<user>/emailAddress=blah
is
not authorized to login other users
The user that I'm trying to submit the build from is kojiadmin (with admin permissions).
The reason that I'd like this, is that I want to use a post-commit trigger to submit a build using the kojiadmin user, but still
submitting
the build as the user that committed the change to SVN.
In auth.py:364 I see some mention of a proxyuser, but I don't know
how
to use it.
Can anyone help?
If you're using SSL auth, you need to put the full DN of the client certificate you're logging in with (the DN is printed in the
AuthError)
into the ProxyDN= config entry in hub.conf. This establishes that the client using that DN is authorized to log in as another user. -- buildsys mailing list buildsys@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/buildsys -- buildsys mailing list buildsys@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/buildsys
-- buildsys mailing list buildsys@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/buildsys
On 04/22/2010 02:56 AM, Greg Trahair wrote:
I used the wrong terminology :-(
I'm creating a svn post-commit hook that will automatically submit a build if a .spec file has been altered, but I still want the build to be submitted by the user that committed the change to the specfile. I've got it working fine by using the pythonOptions in /etc/httpd/conf.d/kojihub.conf, but it doesn't work if I put the same line (excluding the "'s) in /etc/koji-hub/hub.conf.
I was wondering if you have an example of the hub.conf with multiple proxyDN extries?
The code splits the ProxyDNs option with the vertical bar character "|", so specifying multiple values should just be a matter of concatenating them with |. Leading/trailing whitespace is stripped after splitting, so you could do something like:
ProxyDNs = /C=.../ST=.../O=.../OU=.../CN=.../emailAddress=...@... | /C=.../ST=.../O=.../OU=.../CN=.../emailAddress=...
The reason your previous attempt did not work is that you tried to create a multi-line config entry without indenting the subsequent lines. That's just a quirk of this type of config file.
On 04/22/2010 02:56 AM, Greg Trahair wrote:
I used the wrong terminology :-(
I'm creating a svn post-commit hook that will automatically submit a build if a .spec file has been altered, but I still want the build to be submitted by the user that committed the change to the specfile. I've got it working fine by using the pythonOptions in /etc/httpd/conf.d/kojihub.conf, but it doesn't work if I put the same line (excluding the "'s) in /etc/koji-hub/hub.conf.
I was wondering if you have an example of the hub.conf with multiple proxyDN extries?
The code splits the ProxyDNs option with the vertical bar character "|", so specifying multiple values should just be a matter of concatenating them with |. Leading/trailing whitespace is stripped after splitting, so you could do something like:
ProxyDNs = /C=.../ST=.../O=.../OU=.../CN=.../emailAddress=...@... | /C=.../ST=.../O=.../OU=.../CN=.../emailAddress=...
The reason your previous attempt did not work is that you tried to create a multi-line config entry without indenting the subsequent lines. That's just a quirk of this type of config file.
buildsys@lists.fedoraproject.org
-
Greg Trahair -
Mike Bonnet -
Mike McLean