diff --git a/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/authenticator_factory.py b/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/authenticator_factory.py index 9c8395c669..ecc06e4b28 100644 --- a/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/authenticator_factory.py +++ b/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/authenticator_factory.py @@ -23,6 +23,7 @@ def create_authenticator( ) -> Optional[BaseAuthenticator]: if authentication_type == "minikerberos": return MinikerberosGSSAPIAuthenticator( + self.__configuration.krb5_conf_filename(), self.__configuration.keytab_pathname(), self.__configuration.keytab_principal(), self.__configuration.keytab_realm(), @@ -30,6 +31,7 @@ def create_authenticator( ) elif authentication_type == "kinit": return KinitGSSAPIAuthenticator( + self.__configuration.krb5_conf_filename(), self.__configuration.keytab_pathname(), self.__configuration.keytab_principal(), ) # Can kinit the whole process diff --git a/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/base_authenticator.py b/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/base_authenticator.py index 653b3902cb..2110f6b7c8 100644 --- a/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/base_authenticator.py +++ b/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/base_authenticator.py @@ -13,6 +13,7 @@ class BaseAuthenticator(ABC): def __init__( self, + krb5_conf_filename: str, keytab_pathname: str, kerberos_principal: str, kerberos_realm: str = None, @@ -29,6 +30,7 @@ def __init__( "Subsequent operation that require authentication will fail.", countermeasures=f"Ensure a keytab file is located at {f}.", ) + self._krb5_conf_filename = krb5_conf_filename self._keytab_pathname = os.path.abspath(keytab_pathname) self._kerberos_principal = kerberos_principal self._kerberos_realm = kerberos_realm @@ -40,17 +42,14 @@ def __init__( def __str__(self): return str(self.__repr__()) - @staticmethod - def __configure_krb5_config(): - kerberos_module_dir = os.path.dirname(os.path.abspath(__file__)) - krb5_conf_path = os.path.join(kerberos_module_dir, "krb5.conf") - if os.path.exists(krb5_conf_path): - os.environ["KRB5_CONFIG"] = krb5_conf_path + def __configure_krb5_config(self): + if os.path.exists(self._krb5_conf_filename): + os.environ["KRB5_CONFIG"] = self._krb5_conf_filename def authenticate(self): - if not self.is_authenticated(): - if self._kinit(): - self.set_authenticated() + if not self._is_authenticated: + self._kinit() + self._is_authenticated = True else: log.debug( f"Already authenticated, skipping authentication for principal {self._kerberos_principal}." @@ -63,10 +62,6 @@ def is_authenticated(self): # TODO add support for renewal return self._is_authenticated - def set_authenticated(self): - # TODO add support for renewal - self._is_authenticated = True - @abstractmethod def _kinit(self) -> None: """ diff --git a/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/kerberos_configuration.py b/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/kerberos_configuration.py index 78e5b67291..5f67cc8bbf 100644 --- a/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/kerberos_configuration.py +++ b/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/kerberos_configuration.py @@ -7,6 +7,7 @@ KRB_AUTH = "KRB_AUTH" KEYTAB_FOLDER = "KEYTAB_FOLDER" +KRB5_CONF_FILENAME = "KRB5_CONF_FILENAME" KEYTAB_FILENAME = "KEYTAB_FILENAME" KEYTAB_PRINCIPAL = "KEYTAB_PRINCIPAL" KEYTAB_REALM = "KEYTAB_REALM" @@ -37,6 +38,9 @@ def keytab_filename(self): def keytab_pathname(self): return os.path.join(self.keytab_folder(), self.keytab_filename()) + def krb5_conf_filename(self): + return self.__config.get_value(KRB5_CONF_FILENAME) + def keytab_principal(self): keytab_principal = self.__config.get_value(KEYTAB_PRINCIPAL) if keytab_principal is None: @@ -71,6 +75,13 @@ def add_definitions(config_builder: ConfigurationBuilder) -> None: description="Specifies the folder containing the keytab file. " "If left empty, the keytab file is expected to be located inside the data job folder.", ) + config_builder.add( + key=KRB5_CONF_FILENAME, + default_value=os.path.join( + os.path.dirname(os.path.abspath(__file__)), "krb5.conf" + ), + description="Specifies the path to the krb5.conf file that should supply Kerberos configuration.", + ) config_builder.add( key=KEYTAB_PRINCIPAL, default_value=None, diff --git a/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/kinit_authenticator.py b/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/kinit_authenticator.py index eaf3debbcd..339793bde2 100644 --- a/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/kinit_authenticator.py +++ b/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/kinit_authenticator.py @@ -18,8 +18,10 @@ class KinitGSSAPIAuthenticator(BaseAuthenticator): on the machine and the 'kinit' command should be working correctly. """ - def __init__(self, keytab_pathname: str, kerberos_principal: str): - super().__init__(keytab_pathname, kerberos_principal) + def __init__( + self, krb5_conf_filename: str, keytab_pathname: str, kerberos_principal: str + ): + super().__init__(krb5_conf_filename, keytab_pathname, kerberos_principal) self.__configure_current_os_process_to_use_own_kerberos_credentials_cache() diff --git a/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/minikerberos_authenticator.py b/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/minikerberos_authenticator.py index afe74f3d98..e877ba0b93 100644 --- a/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/minikerberos_authenticator.py +++ b/projects/vdk-plugins/vdk-kerberos-auth/src/vdk/plugin/kerberos/minikerberos_authenticator.py @@ -21,13 +21,18 @@ class MinikerberosGSSAPIAuthenticator(BaseAuthenticator): def __init__( self, + krb5_conf_filename: str, keytab_pathname: str, kerberos_principal: str, kerberos_realm: str, kerberos_kdc_hostname: str, ): super().__init__( - keytab_pathname, kerberos_principal, kerberos_realm, kerberos_kdc_hostname + krb5_conf_filename, + keytab_pathname, + kerberos_principal, + kerberos_realm, + kerberos_kdc_hostname, ) self._ccache_file = tempfile.NamedTemporaryFile(