Re: Failing GSSAPI TCP when connecting to server

On Sun, Sep 29, 2024 at 2:00 PM Peter <pmc(at)citylink(dot)dinoex(dot)sub(dot)org> wrote:

> My application is trying to connect the database server, and meanwhile
> tries to talk to the KDC server for a service ticket.
> Earlier these TCP connections did run like this, and were successful:
>
> [snip]

>
> A configuration problem on the machine(s) can be ruled out,

Famous last words.

> because both
> old (working) and new (failing) application are installed on the same
> machine at the same time, using the same network, same hardware, same
> OS, same libgssapi and same postgres client software connecting to the
> same database.
>
> There are no errors logged on the KDC server, it appears to have
> orderly processed the requests (at least at first, it starts to
> complain later when the stale sockets get too many).
>
> The error message on the postgres server is
> FATAL: GSSAPI authentication failed for user "pmc"
>

Is there a way to test pmc authentication via some other tool, like psql?

> The OS is FreeBSD Release 13.4-p1
> The postgres client library libpq.so.5 is Release 15.7
> The application postgres interface is rubyGem pq Release 1.5.4
> The application is Discourse 2.2.0 (working) and 2.3.1 (failing)
>
> What is going on there?
>

If *only *the application changed, then by definition it can't be a
database problem. *Something* in the application changed; you just haven't
found it.

Specifically, I'd read the Discourse 2.3.0 and 2.3.1 release notes.

--
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> crustacean!