Mailing-List: contact reviews-help@aurora.apache.org; run by ezmlm
Precedence: bulk
Reply-To: reviews@aurora.apache.org
Content-Type: multipart/alternative;
 boundary="===============4890530801378708148=="
MIME-Version: 1.0
Subject: Re: Review Request 39797: Adding help message in case kerberos auth
 fails.
From: "Bill Farner" <wfarner@apache.org>
To: "Joshua Cohen" <jcohen@apache.org>, "Bill Farner" <wfarner@apache.org>
Cc: "Maxim Khutornenko" <maxim@apache.org>,
 "Aurora" <reviews@aurora.apache.org>
Date: Mon, 02 Nov 2015 19:02:24 -0000
Message-ID: <20151102190224.16291.3166@reviews.apache.org>
Auto-Submitted: auto-generated
Sender: "Bill Farner" <noreply@reviews.apache.org>
References: <20151030143116.22461.1968@reviews.apache.org>
In-Reply-To: <20151030143116.22461.1968@reviews.apache.org>
Reply-To: "Bill Farner" <wfarner@apache.org>

--===============4890530801378708148==
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit


> On Oct. 30, 2015, 7:31 a.m., Joshua Cohen wrote:
> > src/main/python/apache/aurora/client/api/scheduler_client.py, lines 305-306
> > <https://reviews.apache.org/r/39797/diff/1/?file=1112716#file1112716line305>
> >
> >     It seems like this friendly error message is going to get buried at the top of the stack trace?
> >     
> >     The output will be something like...
> >     
> >         ERROR] Hey! Run kinit!
> >         ERROR] GSS Error: (('Unspecified GSS failure...)
> >         ...
> >         20 lines of stacktrace follow
> >         ...
> >         
> >     I'm not sure if there's any way around that, but it would certainly be nice to have "run kinit" be the last thing the user sees in the cases of these failures...
> 
> Maxim Khutornenko wrote:
>     The stack is logged by requests-kerberos [1] before we get any chance to react to it. I don't see an easy way to disable that logging without hiding other (possibly important for troubleshooting) requests messages.
>     
>     [1] - https://github.com/requests/requests-kerberos/blob/master/requests_kerberos/kerberos_.py#L105-L133

Can you use the verbose flag and squash the logging when we're not verbose?  This could cause us to lose information in rare non-repeatable scenarios, but i'd be willing to risk that to provide a better experience in normal cases.


- Bill


-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/39797/#review104566
-----------------------------------------------------------


On Oct. 29, 2015, 7:24 p.m., Maxim Khutornenko wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/39797/
> -----------------------------------------------------------
> 
> (Updated Oct. 29, 2015, 7:24 p.m.)
> 
> 
> Review request for Aurora, Joshua Cohen and Bill Farner.
> 
> 
> Bugs: AURORA-1364
>     https://issues.apache.org/jira/browse/AURORA-1364
> 
> 
> Repository: aurora
> 
> 
> Description
> -------
> 
> The only reasonable way to wire it in is via the AuthModule, which is the only entity aware of the auth approach used.
> 
> Also, dropped AuthModule.payload() as it's no longer needed (SessionKey thrift struct is empty now).
> 
> 
> Diffs
> -----
> 
>   src/main/python/apache/aurora/client/api/scheduler_client.py 8ff21bf64c4a2e6678299439af42e9a0eeacbc7e 
>   src/main/python/apache/aurora/common/auth/auth_module.py e655cad8fbd3d23e3c44cbc38f6b6462d4781d9b 
>   src/main/python/apache/aurora/common/auth/auth_module_manager.py 2d785e7b274cb3be0b96322bc6b65a3c1ef5dfea 
>   src/main/python/apache/aurora/kerberos/auth_module.py fade00504a3122bc4b93e1cc1b7ebac6415303da 
>   src/test/python/apache/aurora/client/api/test_scheduler_client.py 1b4ff9cef167de1e4051e6aaa6e4fb6961fd20f1 
> 
> Diff: https://reviews.apache.org/r/39797/diff/
> 
> 
> Testing
> -------
> 
> ./pants test.pytest --no-fast src/test/python::
> ./src/test/sh/org/apache/aurora/e2e/test_end_to_end.sh
> 
> Example error message:
> ```
> ...
> GSSError: ((' Miscellaneous failure (see text)', 851968), ('No credentials cache file found', -1765328189))
> ERROR] Communication with Aurora scheduler is kerberized. Did you forget to run "kinit"?
> 401 Client Error: Authorization Required
> ```
> 
> 
> Thanks,
> 
> Maxim Khutornenko
> 
>


--===============4890530801378708148==--