Bug 585866

Description of problem:

There are observed issues with qpid python client trying to authenticate using GSSAPI method when GSSAPI/kerberos ticket is not available/valid.

More precisely the observation proves that GSSAP authentication passes when kerberos ticket is available and valid, but when the same command == authentication test is re-run after kdestroy (kerberos ticket cache cleared) then qpid python client hangs in connection_start():

qc_client.py --conn-auth-mechanism GSSAPI -p 43942 --user 0K1TJvtuRzC8n4QjUKSparV --broker mrg-qe-02.lab.eng.brq.redhat.com
Exception in thread Thread-1:
Traceback (most recent call last):
  File "/usr/lib64/python2.4/threading.py", line 442, in __bootstrap
    self.run()
  File "/usr/lib64/python2.4/threading.py", line 422, in run
    self.__target(*self.__args, **self.__kwargs)
  File "/usr/lib/python2.4/site-packages/qpid/connection.py", line 179, in run
    self.delegate.received(op)
  File "/usr/lib/python2.4/site-packages/qpid/delegates.py", line 52, in received
    getattr(self, op.NAME)(ch, op)
  File "/usr/lib/python2.4/site-packages/qpid/delegates.py", line 213, in connection_start
    raise Closed("SASL error: %s" % self.sasl.getError())
Closed: SASL error: Error in sasl_client_start (-1) SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide mor
e information (Unknown code krb5 195)


I believe message might be correct, but client then stops operation and hangs, even the connection timeout does not end this.

Above behavior was detected on both RHEL 5.5. i386 and x86_64.


Version-Release number of selected component (if applicable):


How reproducible:
100%

Steps to Reproduce:
1. set-up kerberos
2. run broker with authentication (--auth yes)
3. perform kinit <user>
4. perform client test
   qc_client.py --conn-auth-mechanism GSSAPI -p 35585 
                --user <existing-user> --broker <broker-host>
   expect everything ok  
5. perform kdestroy
6. perform client test the same as in point 4.
   behavior - hang in connection_start()

Actual results:
qpid python client hangs in connection_start() when GSSAPI authentication fails because of invalid krb ticket.

Expected results:
qpid python client should not hang when GSSAPI authentication fails because of invalid krb ticket.

Additional info:

Example of client run:

qc_client.py --conn-auth-mechanism GSSAPI -p 35585 --user KPml54FCRyIL6GByY --broker mrg-qe-01.lab.eng.brq.redhat.com
qc_client.py --conn-auth-mechanism GSSAPI -p 35585 --user KPml54FCRyIL6GByY --broker mrg-qe-01.lab.eng.brq.redhat.com
Exception in thread Thread-1:
Traceback (most recent call last):
  File "/usr/lib/python2.4/threading.py", line 442, in __bootstrap
    self.run()
  File "/usr/lib/python2.4/threading.py", line 422, in run
    self.__target(*self.__args, **self.__kwargs)
  File "/usr/lib/python2.4/site-packages/qpid/connection.py", line 179, in run
    self.delegate.received(op)
  File "/usr/lib/python2.4/site-packages/qpid/delegates.py", line 52, in received
    getattr(self, op.NAME)(ch, op)
  File "/usr/lib/python2.4/site-packages/qpid/delegates.py", line 213, in connection_start
    raise Closed("SASL error: %s" % self.sasl.getError())
Closed: SASL error: Error in sasl_client_start (-1) SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide mor
e information (No credentials cache found)

qc_client.py --conn-auth-mechanism GSSAPI -p 35585 --user KPml54FCRyIL6GByY --broker mrg-qe-01.lab.eng.brq.redhat.com