From 7c947aa82db4b16dc79a2ce249596884cdc7596c Mon Sep 17 00:00:00 2001 From: Alexander Todorov Date: Fri, 17 Jul 2026 11:42:31 +0000 Subject: [PATCH 1/5] Add wait loop for web server before Kerberos login test The verify-web-login step sometimes fails because curl attempts a Negotiate/Kerberos handshake before the web server inside the container is ready to accept connections, resulting in an empty response. Add a simple retry loop that waits for the login page to return HTTP 200 before proceeding with the Kerberos login test. --- .github/workflows/integration.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index 8e733d3..af719e9 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -57,6 +57,21 @@ jobs: WEB_ADDR=`docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' web_kiwitcms_org` sudo sh -c "echo '$WEB_ADDR web.kiwitcms.org' >> /etc/hosts" + - name: Wait for web server to be ready + run: | + for i in $(seq 1 30); do + if curl -sk -o /dev/null -w '%{http_code}' \ + https://web.kiwitcms.org:8443/accounts/login/ \ + | grep -q 200; then + echo "Web server is ready!" + exit 0 + fi + echo "Waiting for web server... ($i/30)" + sleep 2 + done + echo "Web server didn't become ready" + exit 1 + - name: Install & configure Kerberos client if: matrix.os == 'ubuntu-latest' && matrix.gssapi == 'with' run: | From d65829e8a956b1415ad79d2842b053f04aadd64c Mon Sep 17 00:00:00 2001 From: Alexander Todorov Date: Fri, 17 Jul 2026 12:05:15 +0000 Subject: [PATCH 2/5] Add verbose logging for Kerberos login debugging - Add -v flag to curl to capture full HTTP exchange details - Dump container logs before verify-web-login - Check keytab contents inside container - Dump krb5.conf from container This will help diagnose why the Negotiate handshake fails even though the web server is responding to plain HTTP requests. --- .github/workflows/integration.yml | 7 +++++++ Makefile | 4 ++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index af719e9..85cf0bb 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -93,6 +93,13 @@ jobs: - name: Verify web login with Kerberos if: matrix.os == 'ubuntu-latest' && matrix.gssapi == 'with' run: | + # dump container logs for debugging + docker logs web_kiwitcms_org > /tmp/web-container-stdout.log 2>&1 + # check keytab inside container + docker exec web_kiwitcms_org klist -k /Kiwi/application.keytab > /tmp/keytab-check.log 2>&1 + # check Kerberos config inside container + docker exec web_kiwitcms_org cat /etc/krb5.conf > /tmp/container-krb5.conf 2>&1 + make verify-web-login klist diff --git a/Makefile b/Makefile index c9179a2..54f30cb 100644 --- a/Makefile +++ b/Makefile @@ -54,9 +54,9 @@ verify-curl-with-kerberos: .PHONY: verify-web-login verify-web-login: verify-curl-with-kerberos # grab the page - curl -k -L -o /tmp/curl.log --negotiate -u: \ + curl -k -v -L -o /tmp/curl.log --negotiate -u: \ -b /tmp/cookie.jar -c /tmp/cookie.jar \ - https://web.kiwitcms.org:8443/login/kerberos/ + https://web.kiwitcms.org:8443/login/kerberos/ 2>&1 | tee /tmp/curl-verbose.log # verify user has been logged in cat /tmp/curl.log | grep 'Kiwi TCMS - Dashboard' From 53998b4ee61bef425fa7e3b7f3a5a7d125376e9f Mon Sep 17 00:00:00 2001 From: Alexander Todorov Date: Fri, 17 Jul 2026 12:17:23 +0000 Subject: [PATCH 3/5] Add verbose logging for Kerberos debugging - Add -v flag to curl in verify-web-login to capture full HTTP exchange - Dump container logs, keytab, krb5.conf, httpd error log, and container status to stdout (instead of /tmp/*.log files) so they appear in CI output - This will help diagnose why Negotiate auth fails even though the web server is responding to plain HTTP requests --- .github/workflows/integration.yml | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index 85cf0bb..74a109d 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -93,12 +93,21 @@ jobs: - name: Verify web login with Kerberos if: matrix.os == 'ubuntu-latest' && matrix.gssapi == 'with' run: | - # dump container logs for debugging - docker logs web_kiwitcms_org > /tmp/web-container-stdout.log 2>&1 - # check keytab inside container - docker exec web_kiwitcms_org klist -k /Kiwi/application.keytab > /tmp/keytab-check.log 2>&1 - # check Kerberos config inside container - docker exec web_kiwitcms_org cat /etc/krb5.conf > /tmp/container-krb5.conf 2>&1 + echo "=== Container logs ===" + docker logs web_kiwitcms_org 2>&1 | tail -50 + + echo "=== Keytab check ===" + docker exec web_kiwitcms_org klist -k /Kiwi/application.keytab 2>&1 + + echo "=== krb5.conf from container ===" + docker exec web_kiwitcms_org cat /etc/krb5.conf 2>&1 + + echo "=== httpd error log ===" + docker exec web_kiwitcms_org cat /var/log/httpd/error_log 2>&1 | tail -20 || echo "No error log found" + + echo "=== Container status ===" + docker ps + docker inspect web_kiwitcms_org --format='{{.State.Health.Status}}' 2>&1 || echo "No health check" make verify-web-login klist From cd8b5933d5b7495c0084d6cd035643c3409e8a34 Mon Sep 17 00:00:00 2001 From: Alexander Todorov Date: Fri, 17 Jul 2026 12:27:16 +0000 Subject: [PATCH 4/5] Install klist in Dockerfile.kiwitcms for debugging Add krb5-workstation package which provides the klist command. This allows running 'docker exec web_kiwitcms_org klist -k /Kiwi/application.keytab' to verify the keytab is correctly set up during CI debugging. --- tests/krb5/Dockerfile.kiwitcms | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/krb5/Dockerfile.kiwitcms b/tests/krb5/Dockerfile.kiwitcms index 63d5f73..2218245 100644 --- a/tests/krb5/Dockerfile.kiwitcms +++ b/tests/krb5/Dockerfile.kiwitcms @@ -1,7 +1,7 @@ FROM kiwitcms/kiwi USER 0 -RUN dnf -y --nodocs install gcc krb5-devel python3.12-devel && \ +RUN dnf -y --nodocs install gcc krb5-devel krb5-workstation python3.12-devel && \ dnf clean all USER 1001 From a89ccfc71e32a3bf6bc7d2c7e3b457e80ac29dae Mon Sep 17 00:00:00 2001 From: Alexander Todorov Date: Fri, 17 Jul 2026 12:35:11 +0000 Subject: [PATCH 5/5] Use POST in verify-web-login /login/kerberos/ is POST-only with Django 6 + latest social-auth. curl defaults to GET which returns 405 Method Not Allowed, preventing the Kerberos Negotiate handshake from completing. --- Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 54f30cb..38d0ce2 100644 --- a/Makefile +++ b/Makefile @@ -54,7 +54,7 @@ verify-curl-with-kerberos: .PHONY: verify-web-login verify-web-login: verify-curl-with-kerberos # grab the page - curl -k -v -L -o /tmp/curl.log --negotiate -u: \ + curl -k -v -L -o /tmp/curl.log -X POST --negotiate -u: \ -b /tmp/cookie.jar -c /tmp/cookie.jar \ https://web.kiwitcms.org:8443/login/kerberos/ 2>&1 | tee /tmp/curl-verbose.log