- Verify k5start exists
- Run k5start and check the top most principal (without
this we would need to probably do some regexing through the
klist to attempt to find which principal we want)
- This will re-initialization *existing* kerberos tickets without
need for password.
- Actually show none connection options as a result of more kerberos
work
Signed-off-by: Adam Stokes <astokes(a)fedoraproject.org>
---
src/lib/mh_agent.cpp | 27 +++++++++++++++++++++++++--
1 files changed, 25 insertions(+), 2 deletions(-)
diff --git a/src/lib/mh_agent.cpp b/src/lib/mh_agent.cpp
index bb1a9b6..00cafda 100644
--- a/src/lib/mh_agent.cpp
+++ b/src/lib/mh_agent.cpp
@@ -232,8 +232,7 @@ int print_help(int code, const char *name, const char *arg, void
*userdata)
printf("\nOptions:\n");
printf("\t-h | --help print this help message.\n");
for (lpc = 0; lpc < DIMOF(matahari_options); lpc++) {
- if (matahari_options[lpc].callback
- && matahari_options[lpc].callback != connection_option) {
+ if (matahari_options[lpc].callback) {
printf("\t-%c | --%-10s\t%s\n", matahari_options[lpc].code,
matahari_options[lpc].long_name, matahari_options[lpc].description);
}
@@ -249,6 +248,16 @@ mh_connect(OptionsMap mh_options, OptionsMap amqp_options, int
retry)
int backoff = 0;
GList *srv_records = NULL, *cur_srv_record = NULL;
struct mh_dnssrv_record *record;
+ GError *error = NULL;
+ gboolean ret;
+ const gchar *k5start_bin[] = {
+ "/usr/bin/k5start",
+ "-f",
+ "/etc/krb5.keytab",
+ "-K",
+ "10",
+ "-U",
+ };
if (!mh_options.count("servername") ||
mh_options.count("dns-srv")) {
/*
@@ -320,6 +329,20 @@ mh_connect(OptionsMap mh_options, OptionsMap amqp_options, int
retry)
}
}
}
+ /* Attempt to initiate k5start for credential renewal's without prompting for a
+ * password each time an agent is run
+ */
+ if (mh_options.count("sasl-mechanism")) {
+ if (g_file_test(k5start_bin[0], G_FILE_TEST_IS_EXECUTABLE)) {
+ mh_info("Running k5start");
+ ret = g_spawn_async(NULL, (gchar **) k5start_bin, NULL, G_SPAWN_SEARCH_PATH,
+ NULL, NULL, NULL, &error);
+ if (ret == FALSE) {
+ mh_warn("Unable to initialize kerberos automatic ticket renewal:
%s", error->message);
+ g_error_free(error);
+ }
+ }
+ }
bail:
g_list_free_full(srv_records, mh_dnssrv_record_free);
return NULL;
--
1.7.6.2