modules/fm-orchestrator
1
0
Fork 0
mirror of https://pagure.io/fm-orchestrator.git synced 2026-07-16 19:10:44 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Force the use of a separte Kerberos cache per thread

Browse Source 
When using a single Kerberos cache that is shared among threads,
Koji logins start failing because the cache gets corrupt. This uses
the Linux kernel keyring to store a Kerberos cache per MBS thread.

See https://web.mit.edu/kerberos/krb5-1.12/doc/basic/ccache_def.html
This commit is contained in:
mprahl
2018-12-12 19:04:00 -05:00
parent 654a30129f
commit 7f82275114
4 changed files with 9 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
module_build_service/builder/KojiModuleBuilder.py
View File

@@ -463,18 +463,13 @@ chmod 644 %buildroot/etc/rpm/macros.zz-modules
authtype = koji_config.authtype
log.info("Authenticate session with %r.", authtype)
if authtype == "kerberos":
ccache = getattr(config, "krb_ccache", None)
keytab = getattr(config, "krb_keytab", None)
principal = getattr(config, "krb_principal", None)
log.debug(" ccache: %r, keytab: %r, principal: %r" % (ccache, keytab, principal))
if keytab and principal:
koji_session.krb_login(
principal=principal,
keytab=keytab,
ccache=ccache
)
else:
koji_session.krb_login(ccache=ccache)
if not keytab and principal:
raise ValueError(
"The Kerberos keytab and principal aren't set for Koji authentication")
log.debug(" keytab: %r, principal: %r" % (keytab, principal))
koji_session.krb_login(principal=principal, keytab=keytab)
elif authtype == "ssl":
koji_session.ssl_login(
os.path.expanduser(koji_config.cert),