Bug 2177765

Summary: either backport kerberos fixes or rebase to latest gnome-online-accounts
Product: Red Hat Enterprise Linux 9 Reporter: Ray Strode [halfline] <rstrode>
Component: gnome-online-accountsAssignee: Ray Strode [halfline] <rstrode>
Status: CLOSED ERRATA QA Contact: Michal Odehnal <modehnal>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 9.3CC: atikhono, mcatanza, rstrode, tpelka, tpopela
Target Milestone: rcKeywords: Reopened, Triaged
Target Release: ---Flags: pm-rhel: mirror+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: gnome-online-accounts-3.40.0-3.el9 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-11-07 08:32:55 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2023-06-26   

Description Ray Strode [halfline] 2023-03-13 15:18:48 UTC
gnome-online-accounts has gotten a number of fixes to his kerberos refreshing code recently upstream.

This makes it work better with KCM and KEYRING type kerberos caches.

We should consider either backporting the fixes, or rebasing gnome-online-accounts to the latest upstream version (it's been in a slow moving maintenance mode for quite some time so the rebase isn't going to be adding a bunch of features or anything, mainly bugfixes)

One thing we should make sure when doing this work, is that the KCM in rhel 9 supports change notification.

If not, we'll need to make sure to continue polling in that case.

Comment 1 Ray Strode [halfline] 2023-03-13 15:20:41 UTC
> gnome-online-accounts has gotten a number of fixes to his kerberos refreshing code recently upstream.

uhh s/his/its/

Comment 3 Milan Crha 2023-03-14 15:53:22 UTC
While I'd prefer the rebase, the 3.48.0 will require libsoup3 and librest-1.0 (it had been ported in time of 3.45.1), where none of these is part of the RHEL9 right now, thus the only option is to backport selected commits.

The list of selected commits is quite large to maintain. Maybe just sync the kerberos-related files with the upstream version, +/- ports and other changes? Unless those changes require fixes in other (non-kerberos) files.

(In reply to Ray Strode [halfline] from comment #0)
> One thing we should make sure when doing this work, is that the KCM in rhel
> 9 supports change notification.
> 
> If not, we'll need to make sure to continue polling in that case.

I do not know what this means in practice, I'm sorry.

Comment 4 Michael Catanzaro 2023-03-14 18:04:29 UTC
> I do not know what this means in practice, I'm sorry.

Ray's talking about https://gitlab.gnome.org/GNOME/gnome-online-accounts/-/merge_requests/61 which just got reverted and which we therefore do not want in RHEL 9.

Comment 5 Milan Crha 2023-03-27 10:01:29 UTC
I'm closing this per the above comment.

Comment 6 Ray Strode [halfline] 2023-03-27 12:56:37 UTC
ah that's only a small part of the fixes. It was basically just answering this

"One thing we should make sure when doing this work, is that the KCM in rhel 9 supports change notification."

with a "Nope."

It still would be good to get the other fixes in. I can do the work if you like. I just don't want to step on your toes.

Of course if you feel strongly that these fixes shouldn't go in for some reason, feel free to re-close WONTFIX.

Comment 8 Milan Crha 2023-03-27 13:15:09 UTC
I thought the notifications are one of the main things behind all those commits you listed.

Feel free to backport the other commits, especially if you are willing to take care of any fallout of it (hopefully there will be none, but one never knows). My main concern is that it's a lot of commits, which can be a problem to maintain long term. Whether you pick one-by-one and backport them or you just override the kerberos-backend-files from the upstream version is up to you.

Comment 9 Ray Strode [halfline] 2023-03-27 13:16:28 UTC
sounds good

Comment 10 Ray Strode [halfline] 2023-03-27 13:19:39 UTC
(the kerberos code was originally written to work with FILE and DIR type credential caches. It mostly predates KCM and KEYRING type credential caches, so it had a number of bugs that made it flakey with them [and some general bugs as well])

Comment 16 errata-xmlrpc 2023-11-07 08:32:55 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (gnome-online-accounts bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6440