PR#1648: support multiple realms by kerberos auth -

koji

#1648 support multiple realms by kerberos auth

Merged Oct 10, 2019 by tkopecek. Opened Sep 17, 2019 by julian8628.

julian8628/koji issue/1629 into master

Download 1648.patch

julian8628 commented Sep 17, 2019

a new table user_krb_principals instead of one-on-one mapping users.krb_principal
all APIs related to user or krb principals are changed
now, userinfo of getUser won't contain krb_principal. Instead, it will contain a new list krb_principals having all available princs if krb_princs=True
a new hub option: AllowedKrbRealms to indicate which realms are allowed
a new client option krb_server_realm to allow krbV login to set server realm, which was the same as client princ realm before. This support all clients - cli, builder, web(KrbServerRealm), vmbuilder, gc, kojira, shadow
QueryProcessor has a new queryOpt group, which is used to generate GROUP BY section. By default, this feature is disabled by arg: enable_group=False
with PR #1419, GSSAPI will natively support multiple realms as well, auth_to_local mapping in /etc/krb5.conf is not necessary anymore, we could just set GssapiLocalName Off in httpd.conf

related: #1419
fixes: #1629

breilly commented Sep 17, 2019

Would it make sense to be able to set the server realm in hub.conf or something similar?

julian8628 commented Sep 17, 2019

Would it make sense to be able to set the server realm in hub.conf or something similar?

Do you mean let hub decide which server realm should be used in krbV way?
I think that, client doesn't know the server realm, unless having a new API to return it before aunthenticating. It looks a little complex and maybe introduce some extra time consuming. (client has to call this API, no matter if server realm is the same as the client one)

breilly commented Sep 18, 2019

Makes sense, LGTM as is.

tkopecek commented Oct 10, 2019

:thumbsup:

tkopecek commented Oct 10, 2019

@julian8628 Also here we need simple rebase.

rebased onto 8b43f03f437031c6a0785ec9754e0b778ebc1c7e

Oct 10, 2019

julian8628 commented Oct 10, 2019

rebased

rebased onto bfdcb1bc4c8c1b2fdfded6db207fde38d66e26ed

Oct 10, 2019