Преглед изворни кода

HUE-9521 [kt_renewer] fix to handle renew_lifetime if set to 0m

Mahesh Balakrishnan пре 5 година
родитељ
комит
0af5e238db

+ 2 - 0
desktop/conf.dist/hue.ini

@@ -721,6 +721,8 @@
     ## ccache_path=/var/run/hue/hue_krb5_ccache
     # Path to kinit
     ## kinit_path=/path/to/kinit
+    # Set to false if renew_lifetime in krb5.conf is set to 0m
+    ## krb5_renewlifetime_enabled=true
 
     # Mutual authentication from the server, attaches HTTP GSSAPI/Kerberos Authentication to the given Request object
     ## mutual_authentication="OPTIONAL" or "REQUIRED" or "DISABLED"

+ 2 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -723,6 +723,8 @@
     ## ccache_path=/var/run/hue/hue_krb5_ccache
     # Path to kinit
     ## kinit_path=/path/to/kinit
+    # Set to false if renew_lifetime in krb5.conf is set to 0m
+    ## krb5_renewlifetime_enabled=true
 
     # Mutual authentication from the server, attaches HTTP GSSAPI/Kerberos Authentication to the given Request object
     ## mutual_authentication="OPTIONAL" or "REQUIRED" or "DISABLED"

+ 6 - 0
desktop/core/src/desktop/conf.py

@@ -896,6 +896,12 @@ KERBEROS = ConfigSection(
       type=str,
       default="/var/run/hue/hue_krb5_ccache",
     ),
+    ENABLE_RENEWLIFETIME=Config(
+      key='krb5_renewlifetime_enabled',
+      help=_("set this to false if renew_lifetime in krb5.conf is set to 0m"),
+      type=coerce_bool,
+      default=True,
+    ),
     KINIT_PATH=Config(
       key='kinit_path',
       help=_("Path to Kerberos 'kinit' command."),

+ 3 - 2
desktop/core/src/desktop/kt_renewer.py

@@ -42,6 +42,7 @@ def renew_from_kt():
                             stderr=subprocess.PIPE, close_fds=True,
                             bufsize=-1)
     subp.wait()
+    max_retries = 0 if subp.returncode == 0 else max_retries
     if subp.returncode != 0:
       retries = retries + 1
       LOG.error("Couldn't reinit from keytab! `kinit' exited with %s.\n%s\n%s" % (
@@ -51,13 +52,13 @@ def renew_from_kt():
         LOG.error("FATAL: max_retries of %s reached. Exiting..." % max_retries)
         sys.exit(subp.returncode)
       time.sleep(3)
-    else:
+    elif CONF.ENABLE_RENEWLIFETIME.get() and max_retries == 0:
       break
 
   global NEED_KRB181_WORKAROUND
   if NEED_KRB181_WORKAROUND is None:
     NEED_KRB181_WORKAROUND = detect_conf_var()
-  if NEED_KRB181_WORKAROUND:
+  if NEED_KRB181_WORKAROUND and CONF.ENABLE_RENEWLIFETIME.get():
     # HUE-640. Kerberos clock have seconds level granularity. Make sure we
     # renew the ticket after the initial valid time.
     time.sleep(1.5)