From 5ca2b7939e4092c534250378862f7d338d557c86 Mon Sep 17 00:00:00 2001
From: Lukas Holecek <hluk@email.cz>
Date: Jul 23 2019 05:13:20 +0000
Subject: Add krb_principal option for waiverdb-cli


By default Kerberos tries to use FQDN of the server. E.g. if client.conf
contains:

    [waiverdb]
    auth_method=Kerberos
    api_url=https://waiverdb.example.com/api/v1.0

And FQDN of "waiverdb.example.com" is "web-waiverdb.app.os.example.com"
the Kerberos principal will be
"HTTP/web-waiverdb.app.os.example.com@EXAMPLE.COM" which may not match
the principal in server's keytab.

This can be changed by using different configuration file with
`dns_canonicalize_hostname=false` setting and setting path to the file
using `KRB5_CONFIG` environment variable.

The new option `krb_principal` allows to override the Kerberos principal
in waiverdb-cli configuration file instead. E.g:

    [waiverdb]
    auth_method=Kerberos
    api_url=https://waiverdb.example.com/api/v1.0
    krb_principal=HTTP/waiverdb.example.com@EXAMPLE.COM

Signed-off-by: Lukas Holecek <hluk@email.cz>

---

diff --git a/conf/client.conf.example b/conf/client.conf.example
index d8353a3..cd65dc1 100644
--- a/conf/client.conf.example
+++ b/conf/client.conf.example
@@ -2,6 +2,8 @@
 # Specify OIDC or Kerberos for authentication
 auth_method=OIDC
 api_url=https://waiverdb-web-waiverdb.app.os.fedoraproject.org/api/v1.0
+# Try overriding Kerberos principal if authentication fails
+#krb_principal=HTTP/waiverdb.example.com@EXAMPLE.COM
 oidc_id_provider=https://id.fedoraproject.org/openidc/
 oidc_client_id=waiverdb-authorizer
 oidc_client_secret=notsecret
diff --git a/waiverdb/cli.py b/waiverdb/cli.py
index 3612d61..ff9defe 100644
--- a/waiverdb/cli.py
+++ b/waiverdb/cli.py
@@ -34,6 +34,37 @@ class OldJSONSubject(click.ParamType):
         return subject
 
 
+def _krb_auth(url, config, request_arguments):
+    # Try to import this now so the user gets immediate feedback if
+    # it isn't installed
+    try:
+        import gssapi  # noqa: F401
+        import requests_gssapi  # noqa: F401
+    except ImportError:
+        raise click.ClickException(
+            'python-requests-gssapi needs to be installed')
+
+    auth_kwargs = {}
+    krb_principal = config.get('waiverdb', 'krb_principal', fallback=None)
+    if krb_principal:
+        auth_kwargs['target_name'] = gssapi.Name(
+            krb_principal, gssapi.NameType.kerberos_principal)
+    auth = requests_gssapi.HTTPSPNEGOAuth(
+        mutual_authentication=requests_gssapi.OPTIONAL, **auth_kwargs)
+
+    resp = requests.request(
+        'POST', url, auth=auth, **request_arguments)
+    if resp.status_code == 401:
+        msg = resp.json().get(
+            'message', ('WaiverDB authentication using GSSAPI failed. Make sure you have a '
+                        'valid Kerberos ticket or that you correctly configured your Kerberos '
+                        'configuration file. Please check the doc for troubleshooting '
+                        'information.'))
+        raise click.ClickException(msg)
+
+    return resp
+
+
 def validate_config(config):
     """
     Validates the configuration needed for WaiverDB
@@ -274,24 +305,7 @@ def cli(username, comment, waived, product_version, testcase, subject, subject_i
             **common_request_arguments)
         check_response(resp, result_ids)
     elif auth_method == 'Kerberos':
-        # Try to import this now so the user gets immediate feedback if
-        # it isn't installed
-        try:
-            import requests_gssapi  # noqa: F401
-        except ImportError:
-            raise click.ClickException(
-                'python-requests-gssapi needs to be installed')
-        auth = requests_gssapi.HTTPKerberosAuth(
-            mutual_authentication=requests_gssapi.OPTIONAL)
-        resp = requests.request(
-            'POST', url, auth=auth, **common_request_arguments)
-        if resp.status_code == 401:
-            msg = resp.json().get(
-                'message', ('WaiverDB authentication using GSSAPI failed. Make sure you have a '
-                            'valid Kerberos ticket or that you correctly configured your Kerberos '
-                            'configuration file. Please check the doc for troubleshooting '
-                            'information.'))
-            raise click.ClickException(msg)
+        resp = _krb_auth(url, config, common_request_arguments)
         check_response(resp, result_ids)
     elif auth_method == 'dummy':
         resp = requests.request(