Re: upcoming build and release developer flag day December 12 2016

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On ma, 21 marras 2016, Vít Ondruch wrote:


Dne 21.11.2016 v 14:18 Vít Ondruch napsal(a):

Dne 21.11.2016 v 14:07 Vít Ondruch napsal(a):
Dne 21.11.2016 v 13:36 Stephen Gallagher napsal(a):
On 11/21/2016 04:24 AM, Tomasz Torcz wrote:
On Sat, Nov 19, 2016 at 07:11:25PM -0600, Dennis Gilmore wrote:
koji authentication will be switching to Kerberos. Koji supports multiple
authentication mechanisms. Fedora infrastructure has set up a freeipa instance
internally that has credential syncing to fas. We are working on ensuring that
gssapi caching is supported so that you can have multiple TGT's and the
ability to work in multiple reams at once. you can get started today by doing
kinit <fas username>@FEDORAPROJECT.ORG if you move your ~/.fedora.cert file
out of the way authentication will still work.
  Can you expand (with links to webpages/wiki?) on multiple TGTs support?
At the moment, when I use kinit on F25, I get ticket for @FEDORAPROJECT.ORG realm,
but I lose my primary principal ticket. This means I lose access to my services,
including access to web proxy being my internet gateway.
  What's the trick to have _both_ tickets active – for my organisation and for
Fedora – at the same time?  This is using default Ticket cache: KEYRING:persistent:…

You don't lose them (you can see both with `klist -A`). What happens is that the
default ticket is the most recent one you got a TGT for. You can switch the
default ticket back to your other one with `kswitch -p username@REALM`.

We should probably look at an /etc/krb5.conf.d snippet to have the
`fedora-packager` RPM provide that will add a section like:

```
[domain_realm]
  fedoraproject.org = FEDORAPROJECT.ORG
  .fedoraproject.org = FEDORAPROJECT.ORG
  fedorainfracloud.org = FEDORAPROJECT.ORG
  .fedorainfracloud.org = FEDORAPROJECT.ORG
```

This way, no matter which ticket is set to the default, it will route requests
for services in those domains to the FEDORAPROJECT.ORG realm.

You mean something like this?

```
# rpm -qf /etc/krb5.conf.d/fedoraproject_org
fedora-packager-0.5.10.7-4.fc26.noarch

# cat /etc/krb5.conf.d/fedoraproject_org
[realms]
 FEDORAPROJECT.ORG = {
        kdc = https://id.fedoraproject.org/KdcProxy

Checking this ^^ against documentation, I wonder how this can be correct:

```
kdc - The  name  or  address  of a host running a KDC for that realm.
An optional port number, separated from the hostname by a colon, may be
included.  If the name or address contains colons (for example, if it is
an IPv6 address), enclose it in square brackets to distinguish the colon
from a port separator.  For your computer to be able to communicate with
the  KDC  for  each  realm, this tag must be given a value in each realm
subsection in the configuration file, or there must be DNS SRV records
specifying the KDCs.
```
The documentation is outdated. MS-KKDCP support allows you to specify an
URI that points to the proxy.


Vít

 }
[domain_realm]
 .fedoraproject.org = FEDORAPROJECT.ORG
 fedoraproject.org = FEDORAPROJECT.ORG
```

But apparently, with this snippet, I can't kinit anymore :/

```
$ kinit vondruch@xxxxxxxxxxxxxxxxx
kinit: Cannot contact any KDC for realm 'FEDORAPROJECT.ORG' while
getting initial credentials
works for me on Fedora 25. You can provide output from
'KRB5_TRACE=/dev/stderr kinit vondruch@xxxxxxxxxxxxxxxxx' to get
further.

--
/ Alexander Bokovoy
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Fedora Announce]     [Fedora Kernel]     [Fedora Testing]     [Fedora Formulas]     [Fedora PHP Devel]     [Kernel Development]     [Fedora Legacy]     [Fedora Maintainers]     [Fedora Desktop]     [PAM]     [Red Hat Development]     [Gimp]     [Yosemite News]
  Powered by Linux