Przeglądaj źródła

Add workaround code to kt_renewer for kerberos 1.8.1

Todd Lipcon 15 lat temu
rodzic
commit
f3e05fa65a
1 zmienionych plików z 31 dodań i 1 usunięć
  1. 31 1
      desktop/core/src/desktop/kt_renewer.py

+ 31 - 1
desktop/core/src/desktop/kt_renewer.py

@@ -23,9 +23,10 @@ from desktop.supervisor import DjangoCommandSupervisee
 from desktop.conf import KERBEROS as CONF
 
 LOG = logging.getLogger(__name__)
-
 SPEC = DjangoCommandSupervisee("kt_renewer")
 
+NEED_KRB181_WORKAROUND=None
+
 def renew_from_kt():
   cmdv = [CONF.KINIT_PATH.get(),
           "-k", # host ticket
@@ -39,6 +40,35 @@ def renew_from_kt():
     LOG.error("Couldn't reinit from keytab!")
     sys.exit(ret)
 
+  global NEED_KRB181_WORKAROUND
+  if NEED_KRB181_WORKAROUND is None:
+    NEED_KRB181_WORKAROUND = detect_conf_var()
+  if NEED_KRB181_WORKAROUND:
+    perform_krb181_workaround()
+
+def perform_krb181_workaround():
+  LOG.debug("Working around krb 181 issue by renewing ticket")
+  cmdv = [CONF.KINIT_PATH.get(),
+          "-R",
+          "-c", CONF.CCACHE_PATH.get()]
+  ret = subprocess.call(cmdv)
+  if ret != 0:
+    LOG.error("Couldn't renew kerberos ticket in order to work around Kerberos 1.8.1 issue")
+    sys.exit(ret)
+
+def detect_conf_var():
+  """Return true if the ticket cache contains "conf" information as is found
+  in ticket caches of Kerboers 1.8.1 or later. This is incompatible with the
+  Sun Java Krb5LoginModule in Java6, so we need to take an action to work
+  around it.
+  """
+  try:
+    f = file(CONF.CCACHE_PATH.get(), "rb")
+    data = f.read()
+    return "X-CACHECONF:" in data
+  finally:
+    f.close()
+
 def run():
   if CONF.HUE_KEYTAB.get() is None:
     LOG.debug("Keytab renewer not starting, no keytab configured")