Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:

The code in rkerberos.rb to obtain a ticket for communicating with an IPA server calls krb5.get_init_creds_keytab. This is a kinit using a keytab and is inefficient.

There are a number of possible solutions. Here are some suggestions, depending on RHEL release:

RHEL 6:

- Use a cron job to manage the ccache by doing a kinit every 6 hours or so.

OR

- Add logic to init_krb5_ccache to pull apart the ccache and look at expiration times before calling krb5.get_init_creds_keytab.

RHEL 7:

MIT Kerberos 1.11 has the ability to do client-initiated tickets via a keytab. In other words, an automatic kinit if a keytab is present. To do this set the environment variable KRB5_CLIENT_KTNAME to point to the keytab and KRB5CCNAME to the location of the ccache, then do a GSSAPI call such as gss_inquire_cred().

Version-Release number of selected component (if applicable):

foreman-proxy-1.6.0.8-1.el6sat.noarch

Since this issue was entered in Red Hat Bugzilla, the release flag has been
set to ? to ensure that it is properly evaluated for this release.

Created redmine issue http://projects.theforeman.org/issues/7466 from this bug

Upstream bug assigned to None

Upstream bug component is Capsule

Per 6.3 planning, moving out non acked bugs to the backlog

Upstream bug assigned to stbenjam

Upstream bug assigned to stbenjam

Upstream bug component is Uncategorized

Upstream bug component is Capsule

This is an older bug which has been reported upstream. We are not going to track this bug downstream. When the upstream issue is resolved, the next build will contain the fix. Thank you.