浏览代码

HUE-2976 [desktop] Don't set the kinit renewal lifetime

Hue's kerberos configuration variable {{reinit_frequency}}
before this patch did two things. First, it is used in the call to
`kinit -r ${reinit_frequency}m ...`, where the ticket will be a
renewable lifetime in minutes. Second, Hue sleeps `reinit_frequency`
seconds between attempts to renew the ticket. Since it's possible to
configure a KDC that rejects too large renewal times, this can cause
kt_renewer to fail to reject tickets. Instead we should just assume
that the {{krb5.conf}} is properly configured to set a reasonable
renewal time.
Erick Tryzelaar 10 年之前
父节点
当前提交
5b644f0
共有 1 个文件被更改,包括 0 次插入4 次删除
  1. 0 4
      desktop/core/src/desktop/kt_renewer.py

+ 0 - 4
desktop/core/src/desktop/kt_renewer.py

@@ -28,11 +28,7 @@ SPEC = DjangoCommandSupervisee("kt_renewer")
 NEED_KRB181_WORKAROUND=None
 NEED_KRB181_WORKAROUND=None
 
 
 def renew_from_kt():
 def renew_from_kt():
-  # The config is specified in seconds. But we ask for that same amount in
-  # minutes to give ourselves a large renewal buffer.
-  renewal_lifetime = "%sm" % (CONF.KEYTAB_REINIT_FREQUENCY.get(),)
   cmdv = [CONF.KINIT_PATH.get(),
   cmdv = [CONF.KINIT_PATH.get(),
-          "-r", renewal_lifetime,
           "-k", # host ticket
           "-k", # host ticket
           "-t", CONF.HUE_KEYTAB.get(), # specify keytab
           "-t", CONF.HUE_KEYTAB.get(), # specify keytab
           "-c", CONF.CCACHE_PATH.get(), # specify credentials cache
           "-c", CONF.CCACHE_PATH.get(), # specify credentials cache