[GODRIVER-818] Go driver does not respect KRB5CCNAME environment variable Created: 08/Feb/19 Updated: 27/Oct/23 Resolved: 14/Feb/19 |
|
| Status: | Closed |
| Project: | Go Driver |
| Component/s: | Authentication |
| Affects Version/s: | None |
| Fix Version/s: | None |
| Type: | Bug | Priority: | Major - P3 |
| Reporter: | Timothy Olsen (Inactive) | Assignee: | Jeffrey Yemin |
| Resolution: | Works as Designed | Votes: | 0 |
| Labels: | None | ||
| Remaining Estimate: | Not Specified | ||
| Time Spent: | Not Specified | ||
| Original Estimate: | Not Specified | ||
| Attachments: |
|
||||||||||||
| Issue Links: |
|
||||||||||||
| Description |
|
I am having trouble getting the Go driver to pay attention to the KRB5CCNAME environment variable for the location of the user's ticket cache:
The Go driver is looking in /etc/krb5/user/1000/client.keytab instead of /tmp/myticketcache . Attaching krb_go_driver.go and the mongod.conf for MongoDB |
| Comments |
| Comment by Jeffrey Yemin [ 14/Feb/19 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Turns out the environment variable was a red herring. Authentication fails with or without it. The root cause is actually | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Timothy Olsen (Inactive) [ 14/Feb/19 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Attached krb_mgo.go | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Timothy Olsen (Inactive) [ 14/Feb/19 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
The kerberos config file does not seem to make a difference. Whether I specify KRB5_CONFIG or not, the result is the same. Maybe kerberos is able to get everything it needs from the keytab file in order to get tickets. First I get a ticket:
Then if I try to run the go driver program:
But mgo works:
Whether I specify KRB5_CONFIG or not makes no difference. Prepending the KRB5_CONFIG with FILE:/ or not also makes no difference. Prepending KRB5CCNAME with FILE:/ or not makes no difference as well. Happy to post output from any of those combinations or anything else you can think of to try. Attaching krb_mgo.go now. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Jeffrey Yemin [ 13/Feb/19 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Hi Tim, Been discussing this over Slack with craig.wilson@mongodb.com and spencer.jackson The main difference is that the Go driver uses libkrb5 directly, whereas mgo uses Cyrus SASL (which uses libkrb5). Comparing our use of libkrb5 with Cyrus yields a lot of differences in how that library is used. We're trying to figure out the root cause. spencer.jackson also asks two things: 1. Try with KRB5CCNAME=FILE:/tmp/myticketcache | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Comment by Timothy Olsen (Inactive) [ 08/Feb/19 ] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
What is the file /etc/krb5/user/1000/client.keytab anyway? There's not even a /etc/krb5 directory on my machine. The default ticket cache for kinit is /tmp/krb5cc_1000 |