fedora-infrastructure

#7599 [fedpkg build] Kerberos authentication fails: unable to obtain a session
Closed: Fixed by kevin. Opened by jpopelka.

Closed: Fixed
Reopen Issue

Hello,

I've been investigating why our bot (usercont@FEDORAPROJECT.ORG) can't do 'fedpkg build' and realized that neither can I (jpopelka@FEDORAPROJECT.ORG).

(master) $ fedpkg --verbose build
Creating repo object from /home/jpopelka/.../conu
Package conu has stream branches: []
Initiating a koji session to https://koji.fedoraproject.org/kojihub
Logging into https://koji.fedoraproject.org/kojihub with Kerberos authentication.
Kerberos authentication fails: unable to obtain a session
Logout kojisession
Could not execute build: Could not login to https://koji.fedoraproject.org/kojihub
Traceback (most recent call last):
  File "/usr/bin/fedpkg", line 11, in <module>
    load_entry_point('fedpkg==1.36', 'console_scripts', 'fedpkg')()
  File "/usr/lib/python3.7/site-packages/fedpkg/__main__.py", line 86, in main
    sys.exit(client.args.command())
  File "/usr/lib/python3.7/site-packages/pyrpkg/cli.py", line 1611, in build
    task_id = self._build(sets=sets)
  File "/usr/lib/python3.7/site-packages/fedpkg/cli.py", line 1111, in _build
    return super(fedpkgClient, self)._build(sets)
  File "/usr/lib/python3.7/site-packages/pyrpkg/cli.py", line 1668, in _build
    fail_fast=self.args.fail_fast)
  File "/usr/lib/python3.7/site-packages/pyrpkg/__init__.py", line 2205, in build
    build_target = self.kojisession.getBuildTarget(self.target)
  File "/usr/lib/python3.7/site-packages/pyrpkg/__init__.py", line 255, in kojisession
    self.load_kojisession()
  File "/usr/lib/python3.7/site-packages/pyrpkg/__init__.py", line 412, in load_kojisession
    self.login_koji_session(koji_config, self._kojisession)
  File "/usr/lib/python3.7/site-packages/pyrpkg/__init__.py", line 382, in login_koji_session
    raise rpkgError('Could not login to %s' % koji_config['server'])
pyrpkg.errors.rpkgError: Could not login to https://koji.fedoraproject.org/kojihub
$ klist
Ticket cache: KEYRING:persistent:1000:krb_ccache_qboR4zy
Default principal: jpopelka@FEDORAPROJECT.ORG
Valid starting       Expires              Service principal
02/27/2019 17:40:34  02/28/2019 03:40:11  HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG
02/27/2019 17:40:17  02/28/2019 03:40:11  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG

I'm sorry if I'm missing something obvious or this is not the place to report it.

I'm seeing the same issue when I try to run kinit:

[elyscape@elyscape-fedora ~]$ kinit elyscape@FEDORAPROJECT.ORG
kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting initial credentials

The debug logs hint at what's going on:

[elyscape@elyscape-fedora ~]$ KRB5_TRACE=/dev/stderr kinit elyscape@FEDORAPROJECT.ORG
[2400] 1551313268.237943: Getting initial credentials for elyscape@FEDORAPROJECT.ORG
[2400] 1551313268.237945: Sending unauthenticated request
[2400] 1551313268.237946: Sending request (217 bytes) to FEDORAPROJECT.ORG
[2400] 1551313268.237947: Resolving hostname id.fedoraproject.org
[2400] 1551313268.237948: TLS certificate name matched "id.fedoraproject.org"
[2400] 1551313268.237949: Sending HTTPS request to https 67.203.2.67:443
[2400] 1551313268.237950: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Thu, 28 Feb 2019 00:21:08 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aX-Frame-Options: SAMEORIGIN\x0d\x0aX-Xss-Protection: 1; mode=block\x0d\x0aX-Content-Type-Options: nosniff\x0d\x0aReferrer-Policy: same-origin\x0d\x0aContent-Length: 206\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0aAppTime: D=45103\x0d\x0aAppServer: proxy08.fedoraproject.org\x0d\x0aConnection: close\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a<html><head>\x0a<title>404 Not Found</title>\x0a</head><body>\x0a<h1>Not Found</h1>\x0a<p>The requested URL /KdcProxy was not found on this server.</p>\x0a</body></html>\x0a
[2400] 1551313268.237951: Terminating TCP connection to https 67.203.2.67:443
[2400] 1551313268.237952: TLS certificate name matched "id.fedoraproject.org"
[2400] 1551313268.237953: Sending HTTPS request to https 140.211.169.196:443
[2400] 1551313268.237954: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Thu, 28 Feb 2019 00:21:08 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aX-Frame-Options: SAMEORIGIN\x0d\x0aX-Xss-Protection: 1; mode=block\x0d\x0aX-Content-Type-Options: nosniff\x0d\x0aReferrer-Policy: same-origin\x0d\x0aContent-Length: 206\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0aAppTime: D=116526\x0d\x0aAppServer: proxy06.fedoraproject.org\x0d\x0aConnection: close\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a<html><head>\x0a<title>404 Not Found</title>\x0a</head><body>\x0a<h1>Not Found</h1>\x0a<p>The requested URL /KdcProxy was not found on this server.</p>\x0a</body></html>\x0a
[2400] 1551313268.237955: Terminating TCP connection to https 140.211.169.196:443
[2400] 1551313269.47261: TLS certificate name matched "id.fedoraproject.org"
[2400] 1551313269.47262: Sending HTTPS request to https 152.19.134.142:443
[2400] 1551313269.47263: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Thu, 28 Feb 2019 00:21:09 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aX-Frame-Options: SAMEORIGIN\x0d\x0aX-Xss-Protection: 1; mode=block\x0d\x0aX-Content-Type-Options: nosniff\x0d\x0aReferrer-Policy: same-origin\x0d\x0aContent-Length: 206\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0aAppTime: D=177862\x0d\x0aAppServer: proxy04.fedoraproject.org\x0d\x0aConnection: close\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a<html><head>\x0a<title>404 Not Found</title>\x0a</head><body>\x0a<h1>Not Found</h1>\x0a<p>The requested URL /KdcProxy was not found on this server.</p>\x0a</body></html>\x0a
[2400] 1551313269.47264: Terminating TCP connection to https 152.19.134.142:443
[2400] 1551313269.47265: TLS certificate name matched "id.fedoraproject.org"
[2400] 1551313269.47266: Sending HTTPS request to https 152.19.134.198:443
[2400] 1551313269.47267: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Thu, 28 Feb 2019 00:21:09 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aX-Frame-Options: SAMEORIGIN\x0d\x0aX-Xss-Protection: 1; mode=block\x0d\x0aX-Content-Type-Options: nosniff\x0d\x0aReferrer-Policy: same-origin\x0d\x0aContent-Length: 206\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0aAppTime: D=180183\x0d\x0aAppServer: proxy12.fedoraproject.org\x0d\x0aConnection: close\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a<html><head>\x0a<title>404 Not Found</title>\x0a</head><body>\x0a<h1>Not Found</h1>\x0a<p>The requested URL /KdcProxy was not found on this server.</p>\x0a</body></html>\x0a
[2400] 1551313269.47268: Terminating TCP connection to https 152.19.134.198:443
[2400] 1551313270.98169: TLS certificate name matched "id.fedoraproject.org"
[2400] 1551313270.98170: Sending HTTPS request to https 8.43.85.67:443
[2400] 1551313270.98171: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Thu, 28 Feb 2019 00:21:10 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aX-Frame-Options: SAMEORIGIN\x0d\x0aX-Xss-Protection: 1; mode=block\x0d\x0aX-Content-Type-Options: nosniff\x0d\x0aReferrer-Policy: same-origin\x0d\x0aContent-Length: 206\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0aAppTime: D=216092\x0d\x0aAppServer: proxy14.fedoraproject.org\x0d\x0aConnection: close\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a<html><head>\x0a<title>404 Not Found</title>\x0a</head><body>\x0a<h1>Not Found</h1>\x0a<p>The requested URL /KdcProxy was not found on this server.</p>\x0a</body></html>\x0a
[2400] 1551313270.98172: Terminating TCP connection to https 8.43.85.67:443
[2400] 1551313270.98173: TLS certificate name matched "id.fedoraproject.org"
[2400] 1551313270.98174: Sending HTTPS request to https 209.132.181.15:443
[2400] 1551313270.98175: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Thu, 28 Feb 2019 00:21:10 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aX-Frame-Options: SAMEORIGIN\x0d\x0aX-Xss-Protection: 1; mode=block\x0d\x0aX-Content-Type-Options: nosniff\x0d\x0aReferrer-Policy: same-origin\x0d\x0aContent-Length: 206\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0aAppTime: D=3663\x0d\x0aAppServer: proxy10.phx2.fedoraproject.org\x0d\x0aConnection: close\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a<html><head>\x0a<title>404 Not Found</title>\x0a</head><body>\x0a<h1>Not Found</h1>\x0a<p>The requested URL /KdcProxy was not found on this server.</p>\x0a</body></html>\x0a
[2400] 1551313270.98176: Terminating TCP connection to https 209.132.181.15:443
[2400] 1551313270.98177: TLS certificate name matched "id.fedoraproject.org"
[2400] 1551313270.98178: Sending HTTPS request to https 8.43.85.73:443
[2400] 1551313271.165965: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Thu, 28 Feb 2019 00:21:11 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aX-Frame-Options: SAMEORIGIN\x0d\x0aX-Xss-Protection: 1; mode=block\x0d\x0aX-Content-Type-Options: nosniff\x0d\x0aReferrer-Policy: same-origin\x0d\x0aContent-Length: 206\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0aAppTime: D=215389\x0d\x0aAppServer: proxy03.fedoraproject.org\x0d\x0aConnection: close\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a<html><head>\x0a<title>404 Not Found</title>\x0a</head><body>\x0a<h1>Not Found</h1>\x0a<p>The requested URL /KdcProxy was not found on this server.</p>\x0a</body></html>\x0a
[2400] 1551313271.165966: Terminating TCP connection to https 8.43.85.73:443
[2400] 1551313271.165967: TLS certificate name matched "id.fedoraproject.org"
[2400] 1551313271.165968: Sending HTTPS request to https 140.211.169.206:443
[2400] 1551313271.165969: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Thu, 28 Feb 2019 00:21:11 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aX-Frame-Options: SAMEORIGIN\x0d\x0aX-Xss-Protection: 1; mode=block\x0d\x0aX-Content-Type-Options: nosniff\x0d\x0aReferrer-Policy: same-origin\x0d\x0aContent-Length: 206\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0aAppTime: D=120983\x0d\x0aAppServer: proxy09.fedoraproject.org\x0d\x0aConnection: close\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a<html><head>\x0a<title>404 Not Found</title>\x0a</head><body>\x0a<h1>Not Found</h1>\x0a<p>The requested URL /KdcProxy was not found on this server.</p>\x0a</body></html>\x0a
[2400] 1551313271.165970: Terminating TCP connection to https 140.211.169.206:443
[2400] 1551313271.165971: TLS certificate name matched "id.fedoraproject.org"
[2400] 1551313271.165972: Sending HTTPS request to https 67.219.144.68:443
[2400] 1551313271.165973: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Thu, 28 Feb 2019 00:21:11 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aX-Frame-Options: SAMEORIGIN\x0d\x0aX-Xss-Protection: 1; mode=block\x0d\x0aX-Content-Type-Options: nosniff\x0d\x0aReferrer-Policy: same-origin\x0d\x0aContent-Length: 206\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0aAppTime: D=217264\x0d\x0aAppServer: proxy11.fedoraproject.org\x0d\x0aConnection: close\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a<html><head>\x0a<title>404 Not Found</title>\x0a</head><body>\x0a<h1>Not Found</h1>\x0a<p>The requested URL /KdcProxy was not found on this server.</p>\x0a</body></html>\x0a
[2400] 1551313271.165974: Terminating TCP connection to https 67.219.144.68:443
[2400] 1551313272.110556: TLS certificate name matched "id.fedoraproject.org"
[2400] 1551313272.110557: Sending HTTPS request to https 209.132.190.2:443
[2400] 1551313272.110558: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Thu, 28 Feb 2019 00:21:12 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aX-Frame-Options: SAMEORIGIN\x0d\x0aX-Xss-Protection: 1; mode=block\x0d\x0aX-Content-Type-Options: nosniff\x0d\x0aReferrer-Policy: same-origin\x0d\x0aContent-Length: 206\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0aAppTime: D=182813\x0d\x0aAppServer: proxy13.fedoraproject.org\x0d\x0aConnection: close\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a<html><head>\x0a<title>404 Not Found</title>\x0a</head><body>\x0a<h1>Not Found</h1>\x0a<p>The requested URL /KdcProxy was not found on this server.</p>\x0a</body></html>\x0a
[2400] 1551313272.110559: Terminating TCP connection to https 209.132.190.2:443
[2400] 1551313272.110560: TLS certificate name matched "id.fedoraproject.org"
[2400] 1551313272.110561: Sending HTTPS request to https 209.132.181.16:443
[2400] 1551313272.110562: HTTPS error: HTTP/1.1 404 Not Found\x0d\x0aDate: Thu, 28 Feb 2019 00:21:12 GMT\x0d\x0aServer: Apache/2.4.6 (Red Hat Enterprise Linux) mod_auth_gssapi/1.5.1 mod_nss/1.0.14 NSS/3.28.4 mod_wsgi/3.4 Python/2.7.5\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aStrict-Transport-Security: max-age=31536000; preload\x0d\x0aX-Frame-Options: SAMEORIGIN\x0d\x0aX-Xss-Protection: 1; mode=block\x0d\x0aX-Content-Type-Options: nosniff\x0d\x0aReferrer-Policy: same-origin\x0d\x0aContent-Length: 206\x0d\x0aContent-Type: text/html; charset=iso-8859-1\x0d\x0aAppTime: D=10188\x0d\x0aAppServer: proxy01.phx2.fedoraproject.org\x0d\x0aConnection: close\x0d\x0a\x0d\x0a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">\x0a<html><head>\x0a<title>404 Not Found</title>\x0a</head><body>\x0a<h1>Not Found</h1>\x0a<p>The requested URL /KdcProxy was not found on this server.</p>\x0a</body></html>\x0a
[2400] 1551313272.110563: Terminating TCP connection to https 209.132.181.16:443
kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while getting initial credentials

Indeed, the KDC proxy endpoint (https://id.fedoraproject.org/KdcProxy) is returning HTTP 404. This may be a result of #7591, which is likely ongoing.

FWIW this is working for me now. I would recommend trying again when you get a chance.

Yes, this should be all sorted now... Please confirm?

Works for me (jpopelka@FEDORAPROJECT.ORG) but not for the bot (usercont@FEDORAPROJECT.ORG)

$ KRB5_TRACE=/dev/stderr fedpkg --verbose build
Creating repo object from /home/jpopelka/FEDORA_GIT/conu
Package conu has stream branches: []
Initiating a koji session to https://koji.fedoraproject.org/kojihub
Logging into https://koji.fedoraproject.org/kojihub with Kerberos authentication.
[20925] 1551345304.258759: ccselect module realm chose cache KEYRING:persistent:1000:krb_ccache_YN0iMjS with client principal usercont@FEDORAPROJECT.ORG for server principal HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG
[20925] 1551345304.258760: Getting credentials usercont@FEDORAPROJECT.ORG -> HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG using ccache KEYRING:persistent:1000:krb_ccache_YN0iMjS
[20925] 1551345304.258761: Retrieving usercont@FEDORAPROJECT.ORG -> HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG from KEYRING:persistent:1000:krb_ccache_YN0iMjS with result: -1765328243/Matching credential not found
[20925] 1551345304.258762: Retrieving usercont@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG from KEYRING:persistent:1000:krb_ccache_YN0iMjS with result: 0/Success
[20925] 1551345304.258763: Starting with TGT for client realm: usercont@FEDORAPROJECT.ORG -> krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
[20925] 1551345304.258764: Requesting tickets for HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG, referrals on
[20925] 1551345304.258765: Generated subkey for TGS request: aes256-cts/0301
[20925] 1551345304.258766: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[20925] 1551345304.258768: Encoding request body and padata into FAST request
[20925] 1551345304.258769: Sending request (993 bytes) to FEDORAPROJECT.ORG
[20925] 1551345304.258770: Resolving hostname id.fedoraproject.org
[20925] 1551345304.258771: TLS certificate name matched "id.fedoraproject.org"
[20925] 1551345304.258772: Sending HTTPS request to https 152.19.134.142:443
[20925] 1551345305.64679: Received answer (935 bytes) from https 152.19.134.142:443
[20925] 1551345305.64680: Terminating TCP connection to https 152.19.134.142:443
[20925] 1551345305.64681: Response was not from master KDC
[20925] 1551345305.64682: Decoding FAST response
[20925] 1551345305.64683: FAST reply key: aes256-cts/82F6
[20925] 1551345305.64684: TGS reply is for usercont@FEDORAPROJECT.ORG -> HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG with session key aes256-cts/6AEF
[20925] 1551345305.64685: TGS request result: 0/Success
[20925] 1551345305.64686: Received creds for desired service HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG
[20925] 1551345305.64687: Storing usercont@FEDORAPROJECT.ORG -> HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG in KEYRING:persistent:1000:krb_ccache_YN0iMjS
[20925] 1551345305.64689: Creating authenticator for usercont@FEDORAPROJECT.ORG -> HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG, seqnum 265061076, subkey aes256-cts/81DF, session key aes256-cts/6AEF
Kerberos authentication fails: unable to obtain a session
Logout kojisession
Could not execute build: Could not login to https://koji.fedoraproject.org/kojihub
$ klist
Ticket cache: KEYRING:persistent:1000:krb_ccache_YN0iMjS
Default principal: usercont@FEDORAPROJECT.ORG
Valid starting       Expires              Service principal
02/28/2019 10:15:04  02/28/2019 19:46:50  HTTP/proxy10.fedoraproject.org@FEDORAPROJECT.ORG
02/28/2019 10:13:45  02/28/2019 19:46:50  HTTP/proxy01.fedoraproject.org@FEDORAPROJECT.ORG
02/28/2019 09:46:51  02/28/2019 19:46:50  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG

So, based on what I see from your klist -A output, you don't have rdns = false in /etc/krb5.conf.
For Fedora services, you need the default (which is rdns = false) in there, under [libdefaults].

I don't have any rdns in [libdefaults] so it should be set to default.
Edited by jpopelka

Could we try an experiment. Put under [libdefaults] an explicite 'rdns = false' and see if the problem continues. If it doesn't then something has changed our assumptions of defaults or on your system. If the problem continues then we can look elsewhere.

@jpopelka This is a difference between krb5 upstream default versus Fedora downstream default.
Upstream krb5 interprets the lack of rdns = as rdns = True, but the Fedora krb5-libs package comes with an krb5.conf that sets rdns = False, and this is the default I was talking about.

Ok, rdns = false did the trick indeed. Thank you @puiterwijk @smooge

Great. I am going to close this now... reopen or file a new ticket if you still need anything.

:customs:

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.