fedora-infrastructure

#5813 Can't get Kerberos to work: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG'
Closed: Fixed Opened by jussilehtola.

Closed: Fixed
Reopen Issue

I find I'm unable to get fedpkg to work after the recent changes. I'm running CentOS 6 with fedora-packager-0.6.0.1-1.el6.

I've added the necessary
includedir /etc/krb5.conf.d/
to /etc/krb5.conf. What else should I be doing?

CentOS6 doesn't support the HTTPS bridge, and I'm not sure that it support includedir, though it might.

Could you set dns_lookup_kdc=true in /etc/krb5.conf and try again?

If that doesn't work, can you provide your krb5.conf and the output of "KRB5_TRACE=/dev/stdout kinit ..."?

Looks like the issue is the https bridge

$ KRB5_TRACE=/dev/stdout kinit jussilehtola@FEDORAPROJECT.ORG
[3196] 1487778683.622408: Getting initial credentials for jussilehtola@FEDORAPROJECT.ORG
[3196] 1487778683.623304: Sending request (215 bytes) to FEDORAPROJECT.ORG
[3196] 1487778683.623471: Resolving hostname https
kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting initial credentials

Can you also attach your /etc/krb5.conf file?

Metadata Update from @kevin:
- Issue tagged with: authentication

It's the default one with the two requested changes

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log
[libdefaults]
 default_realm = EXAMPLE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
[realms]
 EXAMPLE.COM = {
  kdc = kerberos.example.com
  admin_server = kerberos.example.com
 }
[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM
dns_lookup_kdc=true
includedir /etc/krb5.conf.d/

Okay, so since this is an EL6 system you need to remove the includedir.
Then look in [libdefaults] and there is already a line for dns_lookup_kdc.
Please set that one to true.

The problem is that it doesn't know what the HTTPS bridge is, and as such misparses our configuration.

Great, that fixed it!

Excellent. Thanks. :see_no_evil:

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None

authentication

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.