#5618 kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting initial credentials
Closed: Fixed Opened by crash.

I perform all of my Fedora packaging chores on a RHEL7 host.
I haven't updated any of the 5 new "Flag Day" packages for
running fedpkg, but given that a kerberos ticket is required
as a prerequisite, I'm simply trying to get that to work first.

On my RHEL7 machine, in my /etc/kr5b.conf file, I have added this
under [realms]:

FEDORAPROJECT.ORG = {
kdc = https://id.fedoraproject.org/KdcProxy
}

and this under [domain_realm]:

fedoraproject.org = FEDORAPROJECT.ORG
.fedoraproject.org = FEDORAPROJECT.ORG

But my kinit attempts fail like so:

$ kinit crash@FEDORAPROJECT.ORG
kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting initial credentials
$

With tracing, maybe there's a clue here as to what's going on?:

$ KRB5_TRACE=/dev/stdout kinit crash@FEDORAPROJECT.ORG
[9826] 1481566653.803265: Resolving unique ccache of type KEYRING
[9826] 1481566653.803305: Getting initial credentials for crash@FEDORAPROJECT.ORG
[9826] 1481566653.803435: Sending request (196 bytes) to FEDORAPROJECT.ORG
[9826] 1481566653.803535: Resolving hostname id.fedoraproject.org
[9826] 1481566653.805718: Terminating TCP connection to https 2604:1580:fe00:0:dead:beef:cafe:fed1:443
[9826] 1481566653.807206: Terminating TCP connection to https 2607:f188::dead:beef:cafe:fed1:443
[9826] 1481566653.808450: Terminating TCP connection to https 2610:28:3090:3001:dead:beef:cafe:fed3:443
[9826] 1481566654.63381: TLS certificate name matched "id.fedoraproject.org"
[9826] 1481566654.179120: Sending HTTPS request to https 140.211.169.206:443
[9826] 1481566654.292520: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Mon, 12 Dec 2016 18:17:34 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux)\x0d\x0aStrict-Transport-Security: max-age=15768000; includeSubDomains; preload\x0d\x0aContent-Length: 313\x0d\x0aConnection: close\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a\x0a404 Not Found\x0a\x0a

Not Found

\x0a

The requested URL /KdcProxy was not found on this server.

\x0a
\x0a
Apache/2.4.6 (Red Hat Enterprise Linux) Server at admin.fedoraproject.org Port 443
\x0a\x0a
[9826] 1481566654.293906: Terminating TCP connection to https 140.211.169.206:443
[9826] 1481566654.404488: TLS certificate name matched "id.fedoraproject.org"
[9826] 1481566654.457687: Sending HTTPS request to https 152.19.134.198:443
[9826] 1481566654.522453: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Mon, 12 Dec 2016 18:17:34 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux)\x0d\x0aStrict-Transport-Security: max-age=15768000; includeSubDomains; preload\x0d\x0aContent-Length: 313\x0d\x0aConnection: close\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a\x0a404 Not Found\x0a\x0a

Not Found

\x0a

The requested URL /KdcProxy was not found on this server.

\x0a
\x0a
Apache/2.4.6 (Red Hat Enterprise Linux) Server at admin.fedoraproject.org Port 443
\x0a\x0a
[9826] 1481566654.523885: Terminating TCP connection to https 152.19.134.198:443
[9826] 1481566654.670082: TLS certificate name matched "id.fedoraproject.org"
[9826] 1481566654.733874: Sending HTTPS request to https 67.219.144.68:443
[9826] 1481566654.803993: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Mon, 12 Dec 2016 18:17:34 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux)\x0d\x0aStrict-Transport-Security: max-age=15768000; includeSubDomains; preload\x0d\x0aContent-Length: 313\x0d\x0aConnection: close\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a\x0a404 Not Found\x0a\x0a

Not Found

\x0a

The requested URL /KdcProxy was not found on this server.

\x0a
\x0a
Apache/2.4.6 (Red Hat Enterprise Linux) Server at admin.fedoraproject.org Port 443
\x0a\x0a
[9826] 1481566654.805337: Terminating TCP connection to https 67.219.144.68:443
[9826] 1481566655.22007: TLS certificate name matched "id.fedoraproject.org"
[9826] 1481566655.130672: Sending HTTPS request to https 67.203.2.67:443
[9826] 1481566655.225514: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Mon, 12 Dec 2016 18:17:35 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux)\x0d\x0aStrict-Transport-Security: max-age=15768000; includeSubDomains; preload\x0d\x0aContent-Length: 313\x0d\x0aConnection: close\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a\x0a404 Not Found\x0a\x0a

Not Found

\x0a

The requested URL /KdcProxy was not found on this server.

\x0a
\x0a
Apache/2.4.6 (Red Hat Enterprise Linux) Server at admin.fedoraproject.org Port 443
\x0a\x0a
[9826] 1481566655.227021: Terminating TCP connection to https 67.203.2.67:443
[9826] 1481566655.486217: TLS certificate name matched "id.fedoraproject.org"
[9826] 1481566655.589979: Sending HTTPS request to https 209.132.181.15:443
[9826] 1481566655.690125: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Mon, 12 Dec 2016 18:17:35 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux)\x0d\x0aStrict-Transport-Security: max-age=15768000; includeSubDomains; preload\x0d\x0aContent-Length: 313\x0d\x0aConnection: close\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a\x0a404 Not Found\x0a\x0a

Not Found

\x0a

The requested URL /KdcProxy was not found on this server.

\x0a
\x0a
Apache/2.4.6 (Red Hat Enterprise Linux) Server at admin.fedoraproject.org Port 443
\x0a\x0a
[9826] 1481566655.691420: Terminating TCP connection to https 209.132.181.15:443
[9826] 1481566655.805745: TLS certificate name matched "id.fedoraproject.org"
[9826] 1481566655.855989: Sending HTTPS request to https 8.43.85.67:443
[9826] 1481566655.904247: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Mon, 12 Dec 2016 18:17:35 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux)\x0d\x0aStrict-Transport-Security: max-age=15768000; includeSubDomains; preload\x0d\x0aContent-Length: 313\x0d\x0aConnection: close\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a\x0a404 Not Found\x0a\x0a

Not Found

\x0a

The requested URL /KdcProxy was not found on this server.

\x0a
\x0a
Apache/2.4.6 (Red Hat Enterprise Linux) Server at admin.fedoraproject.org Port 443
\x0a\x0a
[9826] 1481566655.905717: Terminating TCP connection to https 8.43.85.67:443
[9826] 1481566656.99295: TLS certificate name matched "id.fedoraproject.org"
[9826] 1481566656.183251: Sending HTTPS request to https 66.35.62.162:443
[9826] 1481566656.264717: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Mon, 12 Dec 2016 18:17:36 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux)\x0d\x0aStrict-Transport-Security: max-age=15768000; includeSubDomains; preload\x0d\x0aContent-Length: 313\x0d\x0aConnection: close\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a\x0a404 Not Found\x0a\x0a

Not Found

\x0a

The requested URL /KdcProxy was not found on this server.

\x0a
\x0a
Apache/2.4.6 (Red Hat Enterprise Linux) Server at admin.fedoraproject.org Port 443
\x0a\x0a
[9826] 1481566656.265901: Terminating TCP connection to https 66.35.62.162:443
[9826] 1481566656.530134: TLS certificate name matched "id.fedoraproject.org"
[9826] 1481566656.646331: Sending HTTPS request to https 140.211.169.196:443
[9826] 1481566656.762523: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Mon, 12 Dec 2016 18:17:36 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux)\x0d\x0aStrict-Transport-Security: max-age=15768000; includeSubDomains; preload\x0d\x0aContent-Length: 313\x0d\x0aConnection: close\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a\x0a404 Not Found\x0a\x0a

Not Found

\x0a

The requested URL /KdcProxy was not found on this server.

\x0a
\x0a
Apache/2.4.6 (Red Hat Enterprise Linux) Server at admin.fedoraproject.org Port 443
\x0a\x0a
[9826] 1481566656.763690: Terminating TCP connection to https 140.211.169.196:443
[9826] 1481566656.978656: TLS certificate name matched "id.fedoraproject.org"
[9826] 1481566657.79219: Sending HTTPS request to https 209.132.181.16:443
[9826] 1481566657.177223: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Mon, 12 Dec 2016 18:17:37 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux)\x0d\x0aStrict-Transport-Security: max-age=15768000; includeSubDomains; preload\x0d\x0aContent-Length: 313\x0d\x0aConnection: close\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a\x0a404 Not Found\x0a\x0a

Not Found

\x0a

The requested URL /KdcProxy was not found on this server.

\x0a
\x0a
Apache/2.4.6 (Red Hat Enterprise Linux) Server at admin.fedoraproject.org Port 443
\x0a\x0a
[9826] 1481566657.178416: Terminating TCP connection to https 209.132.181.16:443
[9826] 1481566657.300485: TLS certificate name matched "id.fedoraproject.org"
[9826] 1481566657.350473: Sending HTTPS request to https 152.19.134.142:443
[9826] 1481566657.396436: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Mon, 12 Dec 2016 18:17:37 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux)\x0d\x0aStrict-Transport-Security: max-age=15768000; includeSubDomains; preload\x0d\x0aContent-Length: 313\x0d\x0aConnection: close\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a\x0a404 Not Found\x0a\x0a

Not Found

\x0a

The requested URL /KdcProxy was not found on this server.

\x0a
\x0a
Apache/2.4.6 (Red Hat Enterprise Linux) Server at admin.fedoraproject.org Port 443
\x0a\x0a
[9826] 1481566657.397598: Terminating TCP connection to https 152.19.134.142:443
kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting initial credentials
$


That is a RHEL7.2 machine, which has a bug.
This is fixed in the krb5-workstation that is in RHEL7.3.

(background information: the RHEL7.2 version of krb5-workstation does not have Server Name Indication (SNI), which means that the client is not hitting the right backend. This is indicated by the "The requested URL /KdcProxy was not found")

Thanks for the info -- I'll work on getting the packages up-to-date

Please let us know when you get it working.

:clock1230:

I sure will. I'm planning to do a full rhel-7.3 update tomorrow
because my initial manual attempts resulted in yum dependency-hell.
Thanks!

OK, I've successfully updated to rhel-7.3, and kinit crash@FEDORAPROJECT.ORG works OK.
Thanks for that tip.

Now w/respect to:

python2-cccolutils-1.4-1
fedpkg-1.26-2
fedora-packager-0.6.0.0-1
pyrpkg-1.47-3
koji-1.11.0-1

I don't have python2-cccolutils at all, and the other 4 all need updating:

$ rpm -qa | grep -e fedpkg -e fedora-packager -e pyrpkg -e koji -e python2-cccolutils
fedora-packager-0.5.10.7-1.el7.noarch
brewkoji-1.13-1.el7.noarch
koji-1.10.1-25.2.el7.noarch
fedpkg-1.25-1.el7.noarch
pyrpkg-1.46-3.el7eng.noarch
$

I can go hunt these down, but is there a yum repo I can temporarily plug in
to get these packages?

Thanks,
Dave Anderson

----- Original Message -----

kevin added a new comment to an issue you are following:
``
Please let us know when you get it working.

:clock1230:
``

To reply, visit the link below or just reply to this email
https://pagure.io/fedora-infrastructure/issue/5618

These updates should all be in epel7-testing at this moment. So if you run "yum update --enablerepo=epel7-testing", you should get them.

Can you please point me to the epel7-testing repo?

The epel7-testing repo definition is in the same file as epel7, so if you have epel7 you can just --enablerepo=epel7-testing.

OK, so again these are required:

python2-cccolutils-1.4-1
fedpkg-1.26-2
fedora-packager-0.6.0.0-1
pyrpkg-1.47-3
koji-1.11.0-1

I got the epel-testing.repo file from epel-release-latest-7.noarch.rpm,
but am only able to get updates for 3 out of the 5 packages, i.e.,
fedpkg, pyrpkg and python2-cccolutils:

$ sudo yum list installed python2-cccolutils fedpkg fedora-packager pyrpkg koji
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Installed Packages
fedora-packager.noarch 0.5.10.7-1.el7 @epel
fedpkg.noarch 1.26-2.el7 @epel-testing
koji.noarch 1.10.1-25.2.el7 @brew-dist-git
pyrpkg.noarch 1.47-3.el7 @epel-testing
python2-cccolutils.x86_64 1.4-1.el7 @epel-testing
$

So I'm still looking for the updates to fedora-packager and koji:

$ yum provides fedora-packager
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager
fedora-packager-0.5.10.7-1.el7.noarch : Tools for setting up a fedora maintainer environment
Repo : epel

fedora-packager-0.5.10.7-1.el7.noarch : Tools for setting up a fedora maintainer environment
Repo : @epel

$ yum provides koji
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager
koji-1.10.1-10.el7.noarch : Build system tools
Repo : epel

koji-1.10.1-13.el7.noarch : Build system tools
Repo : epel-testing

koji-1.10.1-25.2.el7.noarch : Build system tools
Repo : rcm-tools-rhel-7-workstation-rpms

koji-1.10.1-25.2.el7.noarch : Build system tools
Repo : @brew-dist-git

$

So no references to fedora-packager-0.6.0.0-1 or koji-1.11.0-1.

Dave

Odd:

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-b92463563b

is the fedora-packager/koji update. It was pushed to testing about 12 hours ago.
So, it might just be mirror lag I guess. Try a 'yum clean all' and see if they show up?

Nope, after "yum clean all", "yum provides" shows exactly the same as above.

ok. I guess you will need to either way a bit and try again, or just get the updates from koji...

Installed Packages
fedora-packager.noarch           0.6.0.0-3.el7             @epel-testing
koji.noarch                                 1.11.0-1.el7             @epel-testing

please do a
yum --enablerepo=epel-testing list koji fedora-packager
to see if that is the problem.

$ sudo yum --enablerepo=epel-testing list koji fedora-packager
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Installed Packages
fedora-packager.noarch 0.5.10.7-1.el7 @epel
koji.noarch 1.10.1-25.2.el7 @brew-dist-git
$

So it looks like your system is hooked up to the internal brew and doesn't have access to the epel-testing. That being the case, I am not sure how to debug as I don't know what firewalls etc are in place to not have access to epel-testing

Except for the fact that I did get the other 3 packages from epel-testing:

$ yum provides fedpkg
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager
fedpkg-1.25-1.el7.noarch : Fedora utility for working with dist-git
Repo : epel

fedpkg-1.26-2.el7.noarch : Fedora utility for working with dist-git
Repo : epel-testing

fedpkg-1.26-2.el7.noarch : Fedora utility for working with dist-git
Repo : @epel-testing

$ yum provides pyrpkg
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager
pyrpkg-1.46-3.el7eng.noarch : Python library for interacting with rpm+git
Repo : rcm-tools-rhel-7-workstation-rpms

pyrpkg-1.46-5.el7.noarch : Python library for interacting with rpm+git
Repo : epel

pyrpkg-1.47-3.el7.noarch : Python library for interacting with rpm+git
Repo : epel-testing

pyrpkg-1.47-3.el7.noarch : Python library for interacting with rpm+git
Repo : @epel-testing

$ yum provides python2-cccolutils
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager
python2-cccolutils-1.4-1.el7.x86_64 : Python Kerberos Credential Cache Collection Utilities
Repo : epel-testing

python2-cccolutils-1.4-1.el7.x86_64 : Python Kerberos Credential Cache Collection Utilities
Repo : @epel-testing

$ rpm -qa | grep -e pyrpkg -e cccol -e fedpkg
pyrpkg-1.47-3.el7.noarch
fedpkg-1.26-2.el7.noarch
python2-cccolutils-1.4-1.el7.x86_64
$

OK your system had access to epel-testing at one point. It does not now. [where now is defined as the moment you were checking earlier. ] I have checked several mirrors and they have the update and the mirrors are checking out that they are in sync with the metadata. I don't know what the network layout is between you and the
mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=testing-epel7&arch=$basearch
servers are so we need to figure out if there is a proxy problem in between you and them. You can try the following:

baseurl=http://dl.fedoraproject.org/pub/epel/testing/7/$basearch
#mirrorlist=https://mirrors.fedoraproject.org/metalink?repo=testing-epel7&arch=$basearch

Yes! That worked! Thanks!

Cool glad to hear it. I am sorry for my short original post. I am not sure why the package is stuck for you but hopefully the workaround will get you by for the time being.

Is everything working for you now?

:mahjong:

Everything's installed OK and kinit works, but I haven't tried anything. Other than
doing the initial kinit, what else has to be performed?

I would suggest to try running "koji hello" to verify that your koji setup is working correctly.

$ kinit crash@FEDORAPROJECT.ORG
Password for crash@FEDORAPROJECT.ORG:
$ klist
Ticket cache: KEYRING:persistent:3369:krb_ccache_09fH8Bu
Default principal: crash@FEDORAPROJECT.ORG

Valid starting Expires Service principal
12/14/2016 09:24:32 12/15/2016 09:24:23 krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
renew until 12/21/2016 09:24:23
$ koji hello
tervehdys, crash!

You are using the hub at https://koji.fedoraproject.org/kojihub
Authenticated via GSSAPI
$

I had to google tervehdys, but am I good to go? ;-)

Great. Please let us know if there's anything else we can help with.

:telephone_receiver:

@kevin changed the status to Closed

I have to say that your help and response time is truly amazing. (I wish I could get this kind of service from our internal Red Hat release-engineering)

Metadata