Browse Source

HUE-640. kt_renewer workaround for krb compat is a race

bc Wong 13 years ago
parent
commit
9aabea09fe
1 changed files with 15 additions and 2 deletions
  1. 15 2
      desktop/core/src/desktop/kt_renewer.py

+ 15 - 2
desktop/core/src/desktop/kt_renewer.py

@@ -44,16 +44,29 @@ def renew_from_kt():
   if NEED_KRB181_WORKAROUND is None:
     NEED_KRB181_WORKAROUND = detect_conf_var()
   if NEED_KRB181_WORKAROUND:
+    # HUE-640. Kerberos clock have seconds level granularity. Make sure we
+    # renew the ticket after the initial valid time.
+    time.sleep(1.5)
     perform_krb181_workaround()
 
 def perform_krb181_workaround():
-  LOG.debug("Working around krb 181 issue by renewing ticket")
   cmdv = [CONF.KINIT_PATH.get(),
           "-R",
           "-c", CONF.CCACHE_PATH.get()]
+  LOG.info("Renewing kerberos ticket to work around kerberos 1.8.1: " +
+           " ".join(cmdv))
   ret = subprocess.call(cmdv)
   if ret != 0:
-    LOG.error("Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue")
+    fmt_dict = dict(princ=CONF.HUE_PRINCIPAL.get(),
+                    ccache=CONF.CCACHE_PATH.get())
+    LOG.error("Couldn't renew kerberos ticket in order to work around "
+              "Kerberos 1.8.1 issue. Please check that the ticket for "
+              "'%(princ)s' is still renewable:\n"
+              "  $ kinit -f -c %(ccache)s\n"
+              "If the 'renew until' date is the same as the 'valid starting' "
+              "date, the ticket cannot be renewed. Please check your KDC "
+              "configuration, and the ticket renewal policy (maxrenewlife) "
+              "for the '%(princ)s' and `krbtgt' principals." % fmt_dict)
     sys.exit(ret)
 
 def detect_conf_var():