bloomberg / jupyterhub-kdcauthenticator Goto Github PK

FROM jupyterhub/jupyterhub

RUN apt-get update && \
    apt-get install --no-install-recommends -y \
        gcc \
        libpam-krb5 \
        krb5-user \
        libkrb5-dev \
        strace \
        wget \
        bzip2 \
        ca-certificates \
        p7zip-full

WORKDIR /opt/conda/bin/
RUN ./pip install git+https://github.com/bloomberg/jupyterhub-kdcauthenticator.git
RUN ./pip install kerberos
RUN ./pip install dockerspawner

# PAM_KRB5CCNAME is not set when opening the session for some reason and so we have to
# explicitly retain the cache created during auth instead.
# Also, turn on pam debug logging
RUN sed -i 's$1000$1000 ccache=/tmp/krb5cc_%u retain_after_close debug$' /etc/pam.d/common-auth
RUN sed -i 's$1000$1000 debug$' /etc/pam.d/common-session

# Configure kerberos
COPY krb5.conf /etc/

# Add the jupyterhub config
COPY jupyterhub_config.py /etc/jupyterhub/

# Add keytab file
COPY http-test.headless.keytab /etc/

WORKDIR /srv/jupyterhub
CMD KRB5_CONFIG="/etc/krb5.conf" KRB5_KTNAME="/etc/http-test.headless.keytab" jupyterhub --no-ssl  --ip=0.0.0.0 --port=8000 --config="/etc/jupyterhub/jupyterhub_config.py" --log-level=DEBUG --Spawner.debug=True

import os

c.JupyterHub.authenticator_class = 'kdcauthenticator.kdcauthenticator.KDCAuthenticator'
c.KDCAuthenticator.service_name = '[email protected]'
c.JupyterHub.spawner_class = 'dockerspawner.DockerSpawner'
notebook_dir = os.environ.get('DOCKER_NOTEBOOK_DIR') or '/home/{user}/notebook'
c.DockerSpawner.notebook_dir = notebook_dir
c.DockerSpawner.volumes = { 'jupyterhub-user-{username}': notebook_dir }

[libdefaults]
  renew_lifetime = 7d
  forwardable = true
  default_realm = MYDOMAIN.COM
  ticket_lifetime = 24h
  clock-skew = 300
#  dns_lookup_realm = false
#  dns_lookup_kdc = false
  default_ccache_name = /tmp/krb5cc_%{uid}
  #default_tgs_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5
  #default_tkt_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5

[domain_realm]
  mydomain.com = MYDOMAIN.COM
  .mydomain.com = MYDOMAIN.COM

[logging]
  default = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmind.log
  kdc = FILE:/var/log/krb5kdc.log

[realms]
  MYDOMAIN.COM = {
    admin_server = kerberos.mydomain.com
    kdc = kerberos.mydomain.com
   database_module = openldap_ldapconf
  }

[dbdefaults]
    ldap_kerberos_container_dn = cn=kerberos,dc=mydomaincomponent

[dbmodules]
   openldap_ldapconf = {
        db_library = kldap
        ldap_kdc_dn = "cn=admin,dc=mydomaincomponent"

                ldap_kadmind_dn = "cn=admin,dc=mydomaincomponent"

                ldap_service_password_file = /etc/krb5kdc/service.keyfile
                        ldap_servers = ldap://kerberos.mydomain.com
        ldap_conns_per_server = 5
   }

JupyterHub kdcauthenticator:160] kerberos.GSSError: (('Unspecified GSS failure.  Minor code may provide more information', 851968), ('No key table entry found matching http-test/mydomain.com@', 39756033))