Bug 2333853

Summary:	Log KDC timeout only once per request
Product:	[Fedora] Fedora	Reporter:	Julien Rische <jrische>
Component:	python-kdcproxy	Assignee:	Julien Rische <jrische>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	cheimes, rharwood
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	python-kdcproxy-1.0.0-18.fc42 python-kdcproxy-1.0.0-18.fc41 python-kdcproxy-1.0.0-16.fc40	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2025-01-07 10:52:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Julien Rische 2024-12-23 15:52:12 UTC

When a FreeIPA domain is configured as an AD proxy, and the SRV AD domain records are not properly set, the KDCProxy WSGI task floods the journal with warning messages.

This problem occurs in case IPA clients and servers are configured to handle and forward Kerberos requests to AD domain controllers, which are discovered by IPA's HTTP KDC proxy using DNS discovery (AD SRV records for Kerberos services). However, in case the AD domain DNS zone contains outdated records pointing to domain controllers which do not exist anymore, or if port 88 of the DNS-resolved domain controller is not reachable for some reason, the HTTP KDC proxy will get stuck in a busy-looping state causing the httpd logs to be flood with error messages until timeout is reached.

The bug is located in the Application:__await_reply() method, where the AD KDC socket is never removed from the list of waiting sockets. There are better ways nowadays to handle data pipelines between sockets in Python, however in this case we are still restricted by the Python 2 API.

We have to keep the WSGI task from logging the same error message at each iteration of the write operation. Ideally, we should introduce an increasing time window between each retry of forwarding the Kerberos request.


Reproducible: Always

Comment 1 Fedora Update System 2025-01-07 09:48:02 UTC

FEDORA-2025-87f47511d8 (python-kdcproxy-1.0.0-18.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-87f47511d8

Comment 2 Fedora Update System 2025-01-07 09:56:00 UTC

FEDORA-2025-7871bb5307 (python-kdcproxy-1.0.0-18.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-7871bb5307

Comment 3 Fedora Update System 2025-01-07 09:56:49 UTC

FEDORA-2025-37321abf83 (python-kdcproxy-1.0.0-16.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-37321abf83

Comment 4 Fedora Update System 2025-01-07 10:52:56 UTC

FEDORA-2025-87f47511d8 (python-kdcproxy-1.0.0-18.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 5 Fedora Update System 2025-01-08 02:12:26 UTC

FEDORA-2025-7871bb5307 has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-7871bb5307`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-7871bb5307

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2025-01-08 03:14:16 UTC

FEDORA-2025-37321abf83 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-37321abf83`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-37321abf83

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2025-01-23 01:43:01 UTC

FEDORA-2025-7871bb5307 (python-kdcproxy-1.0.0-18.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Fedora Update System 2025-01-23 01:48:33 UTC

FEDORA-2025-37321abf83 (python-kdcproxy-1.0.0-16.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.