From 766f39933d0d915d387c23773f75feccbcb7c3b5 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Apr 30 2018 16:49:15 +0000
Subject: Drop KERBEROS_HTTP_HOST configuration handle


In 7288d464a2de48c49a7ca290aa4a5fa453baa4e1, it was assumed that a
default realm was configured on clients when it was not.  This caused
lookup failures because GSSAPI canonicalized to an empty realm string.
However, since GSSAPI will automatically select the client-requested
principal if it exists in the ccache, there's no need for the name
logic at all.

---

diff --git a/waiverdb/auth.py b/waiverdb/auth.py
index 1c1d08d..387b85a 100644
--- a/waiverdb/auth.py
+++ b/waiverdb/auth.py
@@ -4,25 +4,15 @@
 import base64
 import gssapi
 from flask import current_app, Response, g
-from socket import gethostname
 from werkzeug.exceptions import Unauthorized, Forbidden
 
 
 # Inspired by https://github.com/mkomitee/flask-kerberos/blob/master/flask_kerberos.py
 # Later cleaned and ported to python-gssapi
 def process_gssapi_request(token):
-    if current_app.config['KERBEROS_HTTP_HOST']:
-        hostname = current_app.config['KERBEROS_HTTP_HOST']
-    else:
-        hostname = gethostname()
-
-    service_name = gssapi.Name("HTTP@%s" % hostname,
-                               gssapi.NameType.hostbased_service)
-
     try:
         stage = "initialize server context"
-        creds = gssapi.Credentials(name=service_name, usage="accept")
-        sc = gssapi.SecurityContext(usage="accept", creds=creds)
+        sc = gssapi.SecurityContext(usage="accept")
 
         stage = "step context"
         token = sc.step(token if token != "" else None)
diff --git a/waiverdb/config.py b/waiverdb/config.py
index 74adc7d..add3ec6 100644
--- a/waiverdb/config.py
+++ b/waiverdb/config.py
@@ -24,8 +24,6 @@ class Config(object):
     # https://github.com/flask-restful/flask-restful/issues/449
     ERROR_404_HELP = False
     AUTH_METHOD = 'OIDC'  # Specify OIDC, Kerberos or SSL for authentication
-    # Change it if the Kerberos service is not running on which the waiverdb is run.
-    KERBEROS_HTTP_HOST = None
     # Set this to True or False to enable publishing to a message bus
     MESSAGE_BUS_PUBLISH = True
     # Specify fedmsg or stomp for publishing messages