Fedora Account System
Red Hat Associate
Red Hat Customer
When a FreeIPA domain is configured as an AD proxy, and the SRV AD domain records are not properly set, the KDCProxy WSGI task floods the journal with warning messages. This problem occurs in case IPA clients and servers are configured to handle and forward Kerberos requests to AD domain controllers, which are discovered by IPA's HTTP KDC proxy using DNS discovery (AD SRV records for Kerberos services). However, in case the AD domain DNS zone contains outdated records pointing to domain controllers which do not exist anymore, or if port 88 of the DNS-resolved domain controller is not reachable for some reason, the HTTP KDC proxy will get stuck in a busy-looping state causing the httpd logs to be flood with error messages until timeout is reached. The bug is located in the Application:__await_reply() method, where the AD KDC socket is never removed from the list of waiting sockets. There are better ways nowadays to handle data pipelines between sockets in Python, however in this case we are still restricted by the Python 2 API. We have to keep the WSGI task from logging the same error message at each iteration of the write operation. Ideally, we should introduce an increasing time window between each retry of forwarding the Kerberos request. Reproducible: Always
FEDORA-2025-87f47511d8 (python-kdcproxy-1.0.0-18.fc42) has been submitted as an update to Fedora 42. https://bodhi.fedoraproject.org/updates/FEDORA-2025-87f47511d8
FEDORA-2025-7871bb5307 (python-kdcproxy-1.0.0-18.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2025-7871bb5307
FEDORA-2025-37321abf83 (python-kdcproxy-1.0.0-16.fc40) has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2025-37321abf83
FEDORA-2025-87f47511d8 (python-kdcproxy-1.0.0-18.fc42) has been pushed to the Fedora 42 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2025-7871bb5307 has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-7871bb5307` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-7871bb5307 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-37321abf83 has been pushed to the Fedora 40 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-37321abf83` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-37321abf83 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-7871bb5307 (python-kdcproxy-1.0.0-18.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2025-37321abf83 (python-kdcproxy-1.0.0-16.fc40) has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report.