Issue #6590: Unable to use kerberos - fedora-infrastructure

fedora-infrastructure

#6590 Unable to use kerberos

Closed: Upstream Dec 20, 2017 Opened Dec 20, 2017 by sagitter.

Hi all.

I can't use kerberos with my account:

I followed the guidelines from https://fedoraproject.org/wiki/Infrastructure/Kerberos#Command_line but still does not work.
fedora-packager-setup re-ran and generated a new certificate.

Unable to import new package releases with fedpkg:

$ fedpkg -d --user sagitter import ../../package.src.rpm
Could not execute import_srpm: Request is unauthorized.

puiterwijk commented Dec 20, 2017

Could you please tell me what the output is of running the debugging command on https://fedoraproject.org/wiki/Infrastructure/Kerberos#Debugging_problems ?

sagitter commented Dec 20, 2017

$ cd KrbDebug/
[sagitter@localhost KrbDebug]$ ./KrbDebug
test_01_installed (__main__.TestKerberos) ... ok
test_02_using_collection (__main__.TestKerberos) ... FAIL
test_03_configuration (__main__.TestKerberos) ... ok
test_04_kinit (__main__.TestKerberos) ... ok
======================================================================
FAIL: test_02_using_collection (__main__.TestKerberos)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "./KrbDebug", line 43, in test_02_using_collection
    self.fail('Not a collection cache in use: add "default_ccache_name'
AssertionError: Not a collection cache in use: add "default_ccache_name = KEYRING:persistent:%{uid}" to /etc/krb5.conf under [libdefaults]
----------------------------------------------------------------------
Ran 4 tests in 21.396s

puiterwijk commented Dec 20, 2017

Okay, and could you run kinit sagitter@FEDORAPROJECT.ORG and give the output?

sagitter commented Dec 20, 2017

$ kinit sagitter@FEDORAPROJECT.ORG
Password for sagitter@FEDORAPROJECT.ORG:
$

Edited Dec 20, 2017 by sagitter

puiterwijk commented Dec 20, 2017

In that case, the GNOME Online Accounts error is a bug in GOA, and you should report it as a bug on https://bugzilla.redhat.com/.

Metadata Update from @puiterwijk:
- Issue close_status updated to: Upstream
- Issue status updated to: Closed (was: Open)

Dec 20, 2017

puiterwijk commented Dec 20, 2017

Note that after you have run kinit, fedpkg should work. You'll just need to regularly do a manual kinit via the command line.

sagitter commented Dec 20, 2017

There should be something else wrong:

$ kinit sagitter@FEDORAPROJECT.ORG
Password for sagitter@FEDORAPROJECT.ORG: 
[sagitter@localhost fedora-scm]$ fedpkg clone antimony
Cloning into 'antimony'...
ssh: Could not resolve hostname # my fas username
# https: Name or service not known
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
Could not execute clone: Command '['git', 'clone', 'ssh://# My FAS username\n# https://fedoraproject.org/wiki/Infrastructure/Kerberos\nsagitter@pkgs.fedoraproject.org/rpms/antimony', '--origin', 'origin']' returned non-zero exit status 128
[sagitter@localhost fedora-scm]$ fedpkg --user sagitter clone antimony
Cloning into 'antimony'...
remote: Counting objects: 87, done.
remote: Compressing objects: 100% (86/86), done.
remote: Total 87 (delta 41), reused 0 (delta 0)
Receiving objects: 100% (87/87), 16.33 KiB | 2.04 MiB/s, done.
Resolving deltas: 100% (41/41), done.
[sagitter@localhost fedora-scm]$ cd antimony
[sagitter@localhost antimony]$ fedpkg -d --user sagitter import ../../antimony-0.9.3-2.fc27.src.rpm
Could not execute import_srpm: Request is unauthorized.
[sagitter@localhost antimony]$ kinit sagitter@FEDORAPROJECT.ORG
Password for sagitter@FEDORAPROJECT.ORG: 
[sagitter@localhost antimony]$ git status
On branch master
Your branch is up-to-date with 'origin/master'.
Changes to be committed:
  (use "git reset HEAD <file>..." to unstage)
    modified:   antimony.spec
[sagitter@localhost antimony]$ git reset HEAD antimony.spec
Unstaged changes after reset:
M   antimony.spec
[sagitter@localhost antimony]$ git status
On branch master
Your branch is up-to-date with 'origin/master'.
Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
  (use "git checkout -- <file>..." to discard changes in working directory)
    modified:   antimony.spec
no changes added to commit (use "git add" and/or "git commit -a")
[sagitter@localhost antimony]$ git checkout -- antimony.spec
[sagitter@localhost antimony]$ fedpkg -d --user sagitter import ../../antimony-0.9.3-2.fc27.src.rpm
Could not execute import_srpm: Request is unauthorized.
$

puiterwijk commented Dec 20, 2017

Can you please paste the full output without censoring your username? Note that your username is nothing secret, as it's also the same name as the submitter of this ticket.

Also, can you give the output of rpm -q python2-rpkg fedpkg python2-cccolutils koji.

Metadata Update from @puiterwijk:
- Issue status updated to: Open (was: Closed)

Dec 20, 2017

puiterwijk commented Dec 20, 2017

Also, do note that:

certificates from fedora-packager-setup are entirely unused nowadays.
For git cloning/pulling/pushing you still need your ssh key in FAS.

sagitter commented Dec 20, 2017

Can you please paste the full output without censoring your username? Note that your username is nothing secret, as it's also the same name as the submitter of this ticket.

I never censured it.

Also, can you give the output of rpm -q python2-rpkg fedpkg python2-cccolutils koji.

$ rpm -q python2-rpkg fedpkg python2-cccolutils koji
python2-rpkg-1.51-2.fc27.noarch
fedpkg-1.30-4.fc27.noarch
python2-cccolutils-1.5-5.fc27.x86_64
koji-1.14.0-1.fc27.noarch

Metadata Update from @sagitter:
- Issue close_status updated to: Upstream
- Issue status updated to: Closed (was: Open)

Dec 20, 2017

puiterwijk commented Dec 20, 2017

Oh, do you have a file in ~/.fedora.upn by any chance?
If so, please remove that.

Metadata Update from @puiterwijk:
- Issue status updated to: Open (was: Closed)

Dec 20, 2017

sagitter commented Dec 20, 2017

Oh, do you have a file in ~/.fedora.upn by any chance?
If so, please remove that.

[sagitter@localhost fedora-scm]$ rm -rf antimony
[sagitter@localhost]$ mv ~/.fedora.upn ~/.fedora.upn.backup
[sagitter@localhost fedora-scm]$ fedpkg clone antimony
Cloning into 'antimony'...
remote: Counting objects: 87, done.
remote: Compressing objects: 100% (86/86), done.
remote: Total 87 (delta 42), reused 0 (delta 0)
Receiving objects: 100% (87/87), 13.67 KiB | 874.00 KiB/s, done.
Resolving deltas: 100% (42/42), done.
[sagitter@localhost fedora-scm]$ cd antimony
[sagitter@localhost antimony]$ fedpkg import ../../antimony-0.9.3-2.fc27.src.rpm
Could not execute import_srpm: Request is unauthorized.
[sagitter@localhost antimony]$ kinit sagitter@FEDORAPROJECT.ORG
Password for sagitter@FEDORAPROJECT.ORG: 
[sagitter@localhost antimony]$ fedpkg import ../../antimony-0.9.3-2.fc27.src.rpm
Could not execute import_srpm: There are uncommitted changes in your repo
[sagitter@localhost antimony]$ git reset HEAD antimony.spec
Unstaged changes after reset:
M   antimony.spec
[sagitter@localhost antimony]$ git checkout -- antimony.spec
[sagitter@localhost antimony]$ fedpkg import ../../antimony-0.9.3-2.fc27.src.rpm
Could not execute import_srpm: Request is unauthorized.

puiterwijk commented Dec 20, 2017

Okay, that's at least one issue fixed.
Can you try the import this way: KRB5_TRACE=/dev/stdout fedpkg import ../../antimony-0.9.3-2.fc27.src.rpm ?

sagitter commented Dec 20, 2017

[sagitter@localhost antimony]$ kinit sagitter@FEDORAPROJECT.ORG
Password for sagitter@FEDORAPROJECT.ORG: 
[sagitter@localhost antimony]$ KRB5_TRACE=/dev/stdout fedpkg import ../../antimony-0.9.3-2.fc27.src.rpm
Could not execute import_srpm: Request is unauthorized.

sagitter commented Dec 20, 2017

Is this a correct output?

[sagitter@localhost ~]$ kinit -V -l 24h sagitter@FEDORAPROJECT.ORG
Using default cache: 1000
Using principal: sagitter@FEDORAPROJECT.ORG
Password for sagitter@FEDORAPROJECT.ORG: 
[sagitter@localhost ~]$ klist
klist: No credentials cache found
[sagitter@localhost ~]$ klist -A
[sagitter@localhost ~]$

puiterwijk commented Dec 20, 2017

No. Do you have a file called /etc/krb5.conf.d/kcm_default_ccache? If yes, could you remove it and retry?

sagitter commented Dec 20, 2017

Finally ...

[sagitter@localhost ~]$ kinit -V -l 24h sagitter@FEDORAPROJECT.ORG
Using default cache: persistent:1000:1000
Using principal: sagitter@FEDORAPROJECT.ORG
Password for sagitter@FEDORAPROJECT.ORG: 
Authenticated to Kerberos v5
[sagitter@localhost ~]$ klist -A
Ticket cache: KEYRING:persistent:1000:1000
Default principal: sagitter@FEDORAPROJECT.ORG
Valid starting       Expires              Service principal
20/12/2017 18:21:34  21/12/2017 18:21:10  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
    renew until 27/12/2017 18:21:10

Via command-line i'm authorized now.
Still in trouble via GUI.

Thank you.

Edited Dec 20, 2017 by sagitter

puiterwijk commented Dec 20, 2017

Okay, so this is a bug in SSSD-KCM.
So you'd need to file bugs against both sssd-kcm and GNOME Online Accounts in bugzilla.

Metadata Update from @puiterwijk:
- Issue close_status updated to: Upstream
- Issue status updated to: Closed (was: Open)

Dec 20, 2017

Metadata

Assignee

None

Tags

None

Blocking

None

Depending on

None

Priority

None

fedora-infrastructure

#6590 Unable to use kerberos Closed: Upstream Dec 20, 2017 Opened Dec 20, 2017 by sagitter.

Metadata

#6590 Unable to use kerberos

Closed: Upstream Dec 20, 2017 Opened Dec 20, 2017 by sagitter.