#7573 Failure to authenticate with koji with kerberos
Closed: Fixed by kevin. Opened by vda.

Unable to perform a scratch build in koji:

$ kinit vda@FEDORAPROJECT.ORG

$ fedpkg scratch-build --srpm *.src.rpm
Wrote: /home/srcdevel/Thunar/Thunar/Thunar-1.8.4-2.fc30.src.rpm
Kerberos authentication fails: unable to obtain a session
Could not execute scratch_build: Could not login to https://koji.fedoraproject.org/kojihub

Confirmed that this works on coworker's machine. Then we tried "koji hello" and it also acts differently:

Bad one (my machine):
$ koji -d --debug-xmlrpc hello
2019-02-18 12:24:58,647 [DEBUG] koji: Opening new requests session
2019-02-18 12:24:58,648 [DEBUG] koji: Opening new requests session
2019-02-18 12:24:58,648 [DEBUG] koji: url: https://koji.fedoraproject.org/kojihub/ssllogin
2019-02-18 12:24:58,648 [DEBUG] koji: headers: {'User-Agent': 'koji/1', 'Content-Type': 'text/xml', 'Content-Length': '140'}
2019-02-18 12:24:58,648 [DEBUG] koji: data: "\n\nsslLogin\n\n\n\n\n\n"
2019-02-18 12:24:58,648 [DEBUG] koji: stream: True
2019-02-18 12:24:58,648 [DEBUG] koji: auth:
2019-02-18 12:24:58,648 [DEBUG] koji: timeout: 60
2019-02-18 12:24:59,886 [DEBUG] koji: Opening new requests session
2019-02-18 12:24:59,887 [DEBUG] koji: gssapi auth failed: requests_kerberos.exceptions.MutualAuthenticationError: Unable to authenticate

Good one (his machine):
$ koji -d --debug-xmlrpc hello
2019-02-18 12:24:16,103 [DEBUG] koji: Opening new requests session
2019-02-18 12:24:16,104 [DEBUG] koji: Opening new requests session
2019-02-18 12:24:16,104 [DEBUG] koji: url: https://koji.fedoraproject.org/kojihub/ssllogin
2019-02-18 12:24:16,104 [DEBUG] koji: headers: {'User-Agent': 'koji/1', 'Content-Type': 'text/xml', 'Content-Length': '140'}
2019-02-18 12:24:16,104 [DEBUG] koji: data: "\n\nsslLogin\n\n\n\n\n\n"
2019-02-18 12:24:16,104 [DEBUG] koji: stream: True
2019-02-18 12:24:16,104 [DEBUG] koji: auth:
2019-02-18 12:24:16,104 [DEBUG] koji: timeout: 60
2019-02-18 12:24:17,047 [DEBUG] koji: body: b"\n\n\n\n\n\nsession-id\n52689625\n\n<membe
2019-02-18 12:24:17,047 [DEBUG] koji: url: https://koji.fedoraproject.org/kojihub?session-id=52689625&session-key=534-KIhwXZrBiuVL9ZsUR9R&callnum=0
2019-02-18 12:24:17,047 [DEBUG] koji: headers: {'User-Agent': 'koji/1', 'Content-Type': 'text/xml', 'Content-Length': '107'}
2019-02-18 12:24:17,048 [DEBUG] koji: data: "\n\ngetAPIVersion\n\n\n\n"
2019-02-18 12:24:17,048 [DEBUG] koji: stream: True
2019-02-18 12:24:17,048 [DEBUG] koji: timeout: 43200
2019-02-18 12:24:17,244 [DEBUG] koji: body: b"\n\n\n\n1\n\n\n\n" successfully connected to hub
2019-02-18 12:24:17,245 [DEBUG] koji: url: https://koji.fedoraproject.org/kojihub?session-id=52689625&session-key=534-KIhwXZrBiuVL9ZsUR9R&callnum=1
2019-02-18 12:24:17,245 [DEBUG] koji: headers: {'User-Agent': 'koji/1', 'Content-Type': 'text/xml', 'Content-Length': '109'}
2019-02-18 12:24:17,245 [DEBUG] koji: data: "\n\ngetLoggedInUser\n\n\n\n"
2019-02-18 12:24:17,245 [DEBUG] koji: stream: True
2019-02-18 12:24:17,245 [DEBUG] koji: timeout: 43200
2019-02-18 12:24:17,476 [DEBUG] koji: body: b"\n\n\n\n\n\nstatus\n0\n\n\na
hej, michich!
You are using the hub at https://koji.fedoraproject.org/kojihub
Authenticated via GSSAPI

My kerberos session seems to be okay:
$ klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: vda@FEDORAPROJECT.ORG
Valid starting Expires Service principal
02/18/2019 12:04:25 02/18/2019 22:04:20 krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
02/18/2019 12:05:01 02/18/2019 22:04:20 HTTP/proxy01.fedoraproject.org@FEDORAPROJECT.ORG
02/18/2019 12:19:40 02/18/2019 22:04:20 HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG

How can I debug this further? Help?


Can you please do:

KRB5_TRACE=/dev/stdout koji list-tasks --mine

and add the output here?

Also what is 'rdns' set to in /etc/krb5.conf and /etc/krb5.conf.d/* ?

Thanks! I compared /etc/krb5.conf with a working machine and fixed the problem!

Excellent. Glad you got it working!

:koko:

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

Metadata