cannot log in into STAGE forgejo

psklenar commented

2026-06-05 10:13:03 +00:00

Description of request

Hi, I cannt log in into forge into stage env,
'sign in' > 'sign in with fedora account' > "log in with openshift" (this I havent noticed last week) > name+password (the same one works fine with https://stg.fedoraproject.org/wiki/QA/ ) >
403 Permission Denied
Invalid Account

I tried ff or chrome

### Description of request Hi, I cannt log in into forge into stage env, 'sign in' > 'sign in with fedora account' > "log in with openshift" (this I havent noticed last week) > name+password (the same one works fine with https://stg.fedoraproject.org/wiki/QA/ ) > 403 Permission Denied Invalid Account ![image](/attachments/3c38d73c-1f22-459c-8e6b-7195bdf92256) ![image](/attachments/ceb21986-f325-40c9-9b78-22a39d2e0771) ![image](/attachments/b7f35a83-fd5d-47af-8da1-d390e5dd5b38) I tried ff or chrome

image.png

52 KiB

image.png

127 KiB

image.png

81 KiB

zlopez added the

day-to-day

points

02

labels

2026-06-05 10:27:12 +00:00

zlopez commented

2026-06-05 10:30:01 +00:00

Owner

I just tried it out and logged in without issue with my staging account.

I wonder if you just didn't hit some bad ipsilon mood. Could you try it with kerberos ticket?

I just tried it out and logged in without issue with my staging account. I wonder if you just didn't hit some bad ipsilon mood. Could you try it with kerberos ticket?

psklenar commented

2026-06-05 11:04:44 +00:00

Author

it seems that kerberos is not supported with stage:

KRB5_TRACE=/dev/stderr curl -v --negotiate -u : https://forge.stg.fedoraproject.org/oauth/sign_in

[102831] 1780657098.149811: Decoding FAST response
[102831] 1780657098.149864: TGS request result: -1765328377/Server HTTP/wildcard.stg.fedoraproject.org@STG.FEDORAPROJECT.ORG not found in Kerberos database
* gss_init_sec_context() failed: Server HTTP/wildcard.stg.fedoraproject.org@STG.FEDORAPROJECT.ORG not found in Kerberos database. 
* Server auth using Negotiate with user ''
* [HTTP/2] [1] OPENED stream for https://forge.stg.fedoraproject.org/oauth/sign_in
.....
.....
❯ klist
Ticket cache: KEYRING:persistent:1000:krb_ccache_1tX6LMn
Default principal: psklenar@STG.FEDORAPROJECT.ORG

Valid starting       Expires              Service principal
06/05/2026 12:54:59  06/06/2026 12:54:51  krbtgt/STG.FEDORAPROJECT.ORG@STG.FEDORAPROJECT.ORG

I was trying both ff or chrome:
google-chrome --user-data-dir=$(mktemp -d) --auth-server-whitelist="*.stg.fedoraproject.org" https://forge.stg.fedoraproject.org/oauth/sign_in

it seems that kerberos is not supported with stage: KRB5_TRACE=/dev/stderr curl -v --negotiate -u : https://forge.stg.fedoraproject.org/oauth/sign_in ``` [102831] 1780657098.149811: Decoding FAST response [102831] 1780657098.149864: TGS request result: -1765328377/Server HTTP/wildcard.stg.fedoraproject.org@STG.FEDORAPROJECT.ORG not found in Kerberos database * gss_init_sec_context() failed: Server HTTP/wildcard.stg.fedoraproject.org@STG.FEDORAPROJECT.ORG not found in Kerberos database. * Server auth using Negotiate with user '' * [HTTP/2] [1] OPENED stream for https://forge.stg.fedoraproject.org/oauth/sign_in ..... ..... ❯ klist Ticket cache: KEYRING:persistent:1000:krb_ccache_1tX6LMn Default principal: psklenar@STG.FEDORAPROJECT.ORG Valid starting Expires Service principal 06/05/2026 12:54:59 06/06/2026 12:54:51 krbtgt/STG.FEDORAPROJECT.ORG@STG.FEDORAPROJECT.ORG ``` I was trying both ff or chrome: google-chrome --user-data-dir=$(mktemp -d) --auth-server-whitelist="*.stg.fedoraproject.org" https://forge.stg.fedoraproject.org/oauth/sign_in

zlopez commented

2026-06-08 13:07:48 +00:00

Owner

I just tried it with Brave (--auth-server-allowlist=.fedoraproject.org) on https://forge.stg.fedoraproject.org/oauth/sign_in and it worked for my kerberos ticket generated by fkinit -u zlopez.

I tried the curl command as well, but got the same error. So that is probably expected to not work.

I assume there is something wrong with your staging account. What did you get when trying it with Kerberos ticket on ff and chrome?

I just tried it with Brave (`--auth-server-allowlist=.fedoraproject.org`) on https://forge.stg.fedoraproject.org/oauth/sign_in and it worked for my kerberos ticket generated by `fkinit -u zlopez`. I tried the `curl` command as well, but got the same error. So that is probably expected to not work. I assume there is something wrong with your staging account. What did you get when trying it with Kerberos ticket on ff and chrome?

amedvede self-assigned this

2026-06-09 09:21:41 +00:00

kevin commented

2026-06-09 21:43:37 +00:00

Owner

Is this now working for you? I think it was a auth issue with staging forge...

amedvede commented

2026-06-10 06:36:40 +00:00

Member

Hey @psklenar, it's working for me. Can you please clean the cache and try again? There might be a bug because it should bypass all requests except requests for secured endpoints.

psklenar commented

2026-06-10 06:52:28 +00:00

Author

Hi,
its still the same. I cleared ff history && fkinit -u psklenar

ff with setting in 'about:config':
network.negotiate-auth.trusted-uris .redhat.com,.fedoraproject.org

Hi, its still the same. I cleared ff history && fkinit -u psklenar ff with setting in 'about:config': network.negotiate-auth.trusted-uris .redhat.com,.fedoraproject.org

psklenar commented

2026-06-10 06:59:05 +00:00

Author

the same with brave:

❯ klist
Ticket cache: KEYRING:persistent:1000:krb_ccache_iJGnayk
Default principal: psklenar@FEDORAPROJECT.ORG

Valid starting       Expires              Service principal
06/10/2026 08:47:55  06/11/2026 08:47:55  krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG
❯ flatpak run com.brave.Browser --auth-server-allowlist=.fedoraproject.org
[59:59:0610/085810.177852:ERROR:ui/ozone/platform/wayland/gpu/wayland_surface_factory.cc:249] '--ozone-platform=wayland' is not compatible with Vulkan. Consider switching to '--ozone-platform=x11' or disabling Vulkan

the same with brave: ``` ❯ klist Ticket cache: KEYRING:persistent:1000:krb_ccache_iJGnayk Default principal: psklenar@FEDORAPROJECT.ORG Valid starting Expires Service principal 06/10/2026 08:47:55 06/11/2026 08:47:55 krbtgt/FEDORAPROJECT.ORG@FEDORAPROJECT.ORG ❯ flatpak run com.brave.Browser --auth-server-allowlist=.fedoraproject.org [59:59:0610/085810.177852:ERROR:ui/ozone/platform/wayland/gpu/wayland_surface_factory.cc:249] '--ozone-platform=wayland' is not compatible with Vulkan. Consider switching to '--ozone-platform=x11' or disabling Vulkan ```

kparal commented

2026-06-10 07:10:21 +00:00

I'm seeing this:

I'm logging in through standard web-form user+password field. (Kerberos login in Firefox works for production, but I never bothered to enable it for staging, so that shouldn't be a factor).

I cleared all FF cookies for that host, no change.

I'm seeing this: ![image](/attachments/7846f2d9-eb1c-47d6-978e-0a48263f3324) I'm logging in through standard web-form user+password field. (Kerberos login in Firefox works for production, but I never bothered to enable it for staging, so that shouldn't be a factor). I cleared all FF cookies for that host, no change.

image.png

21 KiB

kparal commented

2026-06-10 07:19:53 +00:00

To https://accounts.stg.fedoraproject.org I can log in just fine.

jgroman commented

2026-06-10 07:24:54 +00:00

I am getting 403 on webform login as well.

amedvede commented

2026-06-10 07:40:21 +00:00

Member

This was an infrastructure issue on staging Forgejo, not your account. A recent change put an OpenShift authentication proxy in front of the site for metrics endpoint protection. it incorrectly intercepted the Fedora Account login flow. I'll let you know when it's fixed. Thanks for sharing the info.