Author: croberts
Date: 2012-12-03 18:05:05 +0000 (Mon, 03 Dec 2012)
New Revision: 5558
Modified:
trunk/cumin/bin/cumin-web
trunk/cumin/etc/cumin.conf
trunk/cumin/python/cumin/config.py
trunk/cumin/python/cumin/kerbauth.py
Log:
Additional tweaks for BZ 799129. No longer require kerberos_server since it is actually
looked-up via the kerberos_realm (defined in krb5.conf). Also cleaned-up a log.debug
statement that needed a % instead of a comma.
Modified: trunk/cumin/bin/cumin-web
===================================================================
--- trunk/cumin/bin/cumin-web 2012-11-30 19:15:55 UTC (rev 5557)
+++ trunk/cumin/bin/cumin-web 2012-12-03 18:05:05 UTC (rev 5558)
@@ -71,7 +71,6 @@
cumin.ldap_tls_cacertfile = values.ldap_tls_cacertfile
def set_kerberos_configs(cumin, values):
- cumin.kerberos_server = values.kerberos_server
cumin.kerberos_realm = values.kerberos_realm
def check_cert_files(opts):
Modified: trunk/cumin/etc/cumin.conf
===================================================================
--- trunk/cumin/etc/cumin.conf 2012-11-30 19:15:55 UTC (rev 5557)
+++ trunk/cumin/etc/cumin.conf 2012-12-03 18:05:05 UTC (rev 5558)
@@ -104,7 +104,6 @@
# ldap_tls_cacertfile:
# ldap_tls_cacertdir:
# ldap_timeout: 30
-# kerberos_server:
# kerberos_realm:
#notification-timeout: 180
@@ -311,16 +310,12 @@
## ldap_timeout: 30
## Timeout in seconds for connections to an LDAP server
-## kerberos_server:
-## setting this [in addition to auth:kerb and kerberos_realm] will activate
-## kerberos authentication for cumin. The kerberos_server string should
-## be either the IP address or FQDN of the kerberos_server.
-
## kerberos_realm:
-## setting this [in addition to auth:kerb and kerberos_server] will activate
+## setting this [in addition to auth:kerb] will activate
## kerberos authentication for cumin. This should be set to the realm
## defined by your kerberos server. Typically, this value will be in all caps
-## and look like "EXAMPLE.COM"
+## and look like "EXAMPLE.COM". This value needs to be valid according to
+## your own krb5.conf file (where it is mapped to a kdc server).
## [data]
Modified: trunk/cumin/python/cumin/config.py
===================================================================
--- trunk/cumin/python/cumin/config.py 2012-11-30 19:15:55 UTC (rev 5557)
+++ trunk/cumin/python/cumin/config.py 2012-12-03 18:05:05 UTC (rev 5558)
@@ -141,10 +141,7 @@
param = ConfigParameter(self, "ldap_timeout", int)
param.default = 30
-
- param = ConfigParameter(self, "kerberos_server", str)
- param.default = ""
-
+
param = ConfigParameter(self, "kerberos_realm", str)
param.default = ""
Modified: trunk/cumin/python/cumin/kerbauth.py
===================================================================
--- trunk/cumin/python/cumin/kerbauth.py 2012-11-30 19:15:55 UTC (rev 5557)
+++ trunk/cumin/python/cumin/kerbauth.py 2012-12-03 18:05:05 UTC (rev 5558)
@@ -11,21 +11,19 @@
class CuminAuthenticatorKerberos(object):
def __init__(self, mech, app):
log.info("Initializing %s", self)
- self.kerb_url = app.kerberos_server
self.kerb_realm = app.kerberos_realm
- if (self.kerb_url is not None and self.kerb_realm is not None
- and self.kerb_url is not "" and self.kerb_realm is not
""):
+ if (self.kerb_realm is not None and self.kerb_realm is not ""):
self.valid = True
else:
self.valid = False
log.info("Required values for kerberos_server and kerberos_realm not
set")
def authenticate(self, username, password):
- log.debug("Authenticating for user %s against %s", (username,
self.__class__.__name__))
+ log.debug("Authenticating for user %s against %s" % (username,
self.__class__.__name__))
isAuth = False
if self.valid:
try:
- isAuth = kerberos.checkPassword(username, password, self.kerb_url,
self.kerb_realm)
+ isAuth = kerberos.checkPassword(username, password, "HTTP",
self.kerb_realm)
except Exception, e:
log.debug("Auth failed %s" % e)
else:
Show replies by date