def kerberos_ccache_init(principal, keytab_file, ccache_file=None):
    """
    Checks whether kerberos credential cache has ticket-granting ticket that is valid for at least
    an hour.

    Default ccache is used unless ccache_file is provided. In that case, KRB5CCNAME environment
    variable is set to the value of ccache_file if we successfully obtain the ticket.
    """
    tgt_valid = False
    env = {"LC_ALL": "C"}  # klist uses locales to format date on RHEL7+
    if ccache_file:
        env["KRB5CCNAME"] = ccache_file

    # check if we have tgt that is valid more than one hour
    rc, klist, _ = run(["klist"], extraenv=env)
    if rc == 0:
        for line in klist.splitlines():
            m = re.match(KLIST_TGT_RE, line)
            if m:
                year = m.group("year")
                if len(year) == 2:
                    year = "20" + year

                expires = datetime.datetime(
                    int(year), int(m.group("month")), int(m.group("day")),
                    int(m.group("hour")), int(m.group("minute")), int(m.group("second"))
                )

                if expires - datetime.datetime.now() > datetime.timedelta(hours=1):
                    logger.debug("Valid TGT found, not renewing")
                    tgt_valid = True
                    break

    if not tgt_valid:
        logger.debug("Retrieving kerberos TGT")
        rc, out, err = run(["kinit", "-k", "-t", keytab_file, principal], extraenv=env)
        if rc != 0:
            raise OsbsException("kinit returned %s:\nstdout: %s\nstderr: %s" % (rc, out, err))

    if ccache_file:
        os.environ["KRB5CCNAME"] = ccache_file
def kerberos_ccache_init ( principal , keytab_file , ccache_file = None ) : tgt_valid = False env = { "LC_ALL" : "C" } if ccache_file : env [ "KRB5CCNAME" ] = ccache_file rc , klist , _ = run ( [ "klist" ] , extraenv = env ) if rc == 0 : for line in klist . splitlines ( ) : m = re . match ( KLIST_TGT_RE , line ) if m : year = m . group ( "year" ) if len ( year ) == 2 : year = "20" + year expires = datetime . datetime ( int ( year ) , int ( m . group ( "month" ) ) , int ( m . group ( "day" ) ) , int ( m . group ( "hour" ) ) , int ( m . group ( "minute" ) ) , int ( m . group ( "second" ) ) ) if expires - datetime . datetime . now ( ) > datetime . timedelta ( hours = 1 ) : logger . debug ( "Valid TGT found, not renewing" ) tgt_valid = True break if not tgt_valid : logger . debug ( "Retrieving kerberos TGT" ) rc , out , err = run ( [ "kinit" , "-k" , "-t" , keytab_file , principal ] , extraenv = env ) if rc != 0 : raise OsbsException ( "kinit returned %s:\nstdout: %s\nstderr: %s" % ( rc , out , err ) ) if ccache_file : os . environ [ "KRB5CCNAME" ] = ccache_file
Checks whether kerberos credential cache has ticket-granting ticket that is valid for at least
    an hour.

    Default ccache is used unless ccache_file is provided. In that case, KRB5CCNAME environment
    variable is set to the value of ccache_file if we successfully obtain the ticket.