#10771 https://id.fedoraproject.org/login/gssapi/negotiate asks for a password insteat of using Kerberos
Closed: Fixed 2 years ago by kevin. Opened 2 years ago by ppisar.

Today whenever I try to log into Pagure.io, I'm redirected to https://id.fedoraproject.org/login/gssapi/negotiate?ipsilon_transaction_id=... which instead of using Kerberos to finish the authentication, it insists on filling a FAS user name and password. Then the authentication succeeds.

I tried to delete cookies, empty caches, using a fresh new Firedox profile. Nothing helps. "koji moshimoshi" works. I guess something got broken in Fedora IDP.


Can you start your browser with:

KRB5_TRACE=/dev/stdout browser

and go and try and login and then attach stdout here?

Metadata Update from @kevin:
- Issue priority set to: Waiting on Reporter (was: Needs Review)
- Issue tagged with: low-gain, low-trouble, ops

2 years ago

Today it works. Even with the same Firefox build as yesterday. Maybe there were some problems in IDP that day. Because I got 500 error from IDP few times when using new bodhi client which uses OIDC.

So, yesterday pagure was getting hit with a DDoS for a while until we were able to mitigate it. I suspect you were trying to login in this time and the heavy traffic was messing up communication to the idp. ;(

Please re-open this if you see this again.

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

2 years ago

Login to comment on this ticket.

Metadata
Boards 1
ops Status: Backlog