[LU-3288] Enabling GSSAPI support requires Kerberos libraries to be installed

• Type: Technical task
• Resolution: Fixed
• Priority: Major
• Fix Version/s: Lustre 2.5.0
• Affects Version/s: Lustre 2.3.0, Lustre 2.4.0, Lustre 2.5.0
• Labels: SSK gssapi kerberos
• Environment: any
• Severity: 3
• Assignee: Minh Diep
• Reporter: Andrew Korty (Inactive)

Description

Lustre's autoconf scripts require Kerberos to be installed when --enable-gss is specified. Currently, only the Kerberos GSSAPI mechanism supported by Lustre, but others are planned in the future, such as those being developed for shared key authentication (project SFS-DEV-001.2). GSSAPI is meant to allow calling code to be mechanism-agnostic, so requiring Kerberos defeats that purpose.

The definition of the LC_CONFIG_GSS macro in lustre/autoconf/lustre-core.m4 unconditionally calls AC_KERBEROS_V5 from lustre/autoconf/kerberos.m4, which fails when Kerberos isn't found:

dnl We didn't find a usable Kerberos environment
if test "x$KRBDIR" = "x"; then
if test "x$krb5_with" = "x"; then
AC_MSG_ERROR(Kerberos v5 with GSS support not found: consider --disable-gss or --with-krb5=)
else
AC_MSG_ERROR(Kerberos v5 with GSS support not found at $krb5_with)
fi
fi
AC_MSG_RESULT($KRBDIR)

This macro ought to instead note the location of the Kerberos headers and libraries but not result in a fatal error if they don't exist. I don't know if this approach will result in link-time or runtime errors that would also need to be corrected.

Ubuntu also needs GSS libraries:

configure: error: libkeyutils is not found, which is required by gss keyring backend

Issue Links

• is duplicated by: LU-3681 libkeyutils not installed on build node x86_64,client,ubuntu1004,inkernel
• is related to: LU-3490 GSSAPI support not tested by Gerritt

Comments

[Andrew Korty (Inactive)]

Yes, I believe this ticket has been resolved. Thanks!

[Minh Diep]

Andrew,

Let me know if there's anything else or I can close this ticket. I will close if I don't hear from you by the end of this week.

[Joshua Kugler (Inactive)]

Sounds good. Probably a good idea, then, to close this ticket and open one specifically for Ubuntu.

[Minh Diep]

afaik, LU-3490 has landed and all issues have been resolved. I am not sure what else needs to be done for this ticket. As for the Ubuntu, similar to sles11, it needs more works to include the proper functions

[Joshua Kugler (Inactive)]

Assign-ing to Minh, as I believe he is working on the Ubuntu libs issue.

[Minh Diep]

we also need gssapi for ubuntu

http://build.whamcloud.com/job/lustre-reviews/18264/arch=x86_64,build_type=client,distro=ubuntu1004,ib_stack=inkernel/consoleFull