Project

General

Profile

Bug #23499

Bug #23399: jobsub_client shouldn't care about date format when checking validity of kerberos tickets

Review request [commit:823beeb9552c2fdf0679affbebc55cee9fcfdc43: Catch CalledProcessError if raised when checking kerberos creds for validity]

Added by Shreyas Bhat about 1 month ago. Updated 26 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
JobSub Client
Target version:
Start date:
10/31/2019
Due date:
% Done:

0%

Estimated time:
First Occurred:
Occurs In:
Stakeholders:
Duration:

Description

Please review the change I made here for Bug 23399. I've included in that ticket what I tested. The basic fix was overriding Credentials.isValid for the Krb5Ticket class. Keep in mind that the bug only presents itself in SL7 (something we didn't know before).

Steps to reproduce error:

  1. Log into SL7 machine
  2. export LC_TIME=en_GB.utf8
  3. klist (you should see here that the times are in dd/mm/yyyy format)
  4. setup jobsub_client (1_2_10 or 1_3)
  5. jobsub_q -G nova --user=blah

You should get a parsing error here if the klist date would be invalid as parsed by an American (e.g. 31/10/2019), or an error message saying that the credentials are invalid if the date COULD be parsed, but an American would read it as some time in the past (e.g. 01/11/2019)

All of the above should work without error if you now use this branch's jobsub_client. Further, if you purposefully set up an expired kerberos ticket without the existence of a VOMS proxy (voms-proxy-destroy; kdestroy; klist -l 1s), you should see an error, as well as a debug message (if you use --debug) that says that the kerb ticket validation failed.

Please let me know if you have any questions.

History

#1 Updated by Dennis Box 26 days ago

  • Status changed from New to Closed

Reviewed. Accepted



Also available in: Atom PDF