jborean93
commented
9 months ago Sorry I missed this issue. This library is a wrapper for the gssapi C library and any validation of the ticket or server lookup is done at that lower level which we don't really have control over. The error indicates the server that was used with the SPN was krbtgt/EC2.INTERNAL@US.COTTICOFFEE.GLOBAL whereas your klist entry has it as US.COTTICOFFEE.GLOBAL@US.COTTICOFFEE.GLOBAL. We don't do any DNS lookups here, anything provided to this library is what is provided to the C gssapi library.
You'll have to investigate what is calling spnego here and the values it provides. You might even have some config values in the GSSAPI library being used, for example MIT krb5 has krb5.config.
sangetang
What went wrong?
The above exception was the direct cause of the following exception:
Traceback (most recent call last): File "/home/miniconda3/envs/superset/lib/python3.9/site-packages/requestskerberos/kerberos.py", line 227, in generate_request_header gss_response = ctx.step(in_token=negotiate_resp_value) File "/home/miniconda3/envs/superset/lib/python3.9/site-packages/spnego/_context.py", line 71, in wrapper raise SpnegoError(base_error=native_err, context_msg=context) from native_err spnego.exceptions.SpnegoError: SpnegoError (4294967295): Major (851968): Unspecified GSS failure. Minor code may provide more information, Minor (2529638919): Server krbtgt/EC2.INTERNAL@US.COTTICOFFEE.GLOBAL not found in Kerberos database, Context: Processing security token
How do we reproduce?
AWS EC2 superset add trino database (Remember to use fenced code blocks and consider placing in a gist if large)
Component versions (python-gssapi, Kerberos, OS / distro, etc.)
(Please include MIT/Heimdal/etc. and how you installed python-gssapi)