Bug 1396797

Summary: access to rhevm based guest console is untrusted by chrome and firefox web browsers by default.
Product: Red Hat Satellite Reporter: vdhande
Component: ProvisioningAssignee: satellite6-bugs <satellite6-bugs>
Status: CLOSED NOTABUG QA Contact: Katello QA List <katello-qa-list>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.2.3CC: bbuckingham, inecas, lzap, mgrigull, mlele, vdhande
Target Milestone: UnspecifiedKeywords: Triaged
Target Release: Unused   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-06-15 10:30:36 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description vdhande 2016-11-20 10:36:53 UTC
Created attachment 1222193 [details]
noVNC_blank

Description of problem:
access to rhevm based guest consoles(noVNC) is untrusted by chrome and firefox web browsers by default.

Version-Release number of selected component (if applicable):
Red Hat Satellite 6.2.3


Steps to Reproduce:
1. Deploy a system on RHEVM.
2. Try to access the noVNC console.
3. Getting blank noVNC console to access rhevm based guest. PFA attached screenshot "noVNC_blank.png".

Actual results: noVNC console is blank.


Expected results: noVNC console should be accessible.


Additional info:
Customer informed this issue can be mitigated with the following items:
- in firefox set 'security.csp.enable' to 'false'  via 'about:config'
- in google chrome select the URL bar option to 'run unsafe scripts'

I tried to apply both setting but only google chrome settings worked for me.

Comment 1 Lukas Zapletal 2016-11-22 14:12:54 UTC
Hello,

are you creating VMs with Spice or VNC? Thanks.

Comment 3 Lukas Zapletal 2016-11-24 15:17:31 UTC
Hello,

I have just checked this on Satellite 6.3, but I am assuming the same for 6.2.

What you need to do is to insert this certificate as server CA and then reload the page and console will work out-of-box:

http://satellite.my.lan/pub/katello-server-ca.crt

This URL used to be

http://katello.example.com/pub/katello-default-ca.crt

in older versions of Satellite, use it if the former does not work.

Please confirm, then we can turn this into documentation BZ because I cannot find this in our docs. In the upstream docs, we had the URL wrong:

https://github.com/theforeman/theforeman.org/pull/755/files

Comment 10 Lukas Zapletal 2017-06-15 10:30:36 UTC
Hello,

I am closing this BZ, this works normally here. Please specify exactly what the issue is.

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.2/html-single/installation_guide/#supported_browsers.adoc

https://access.redhat.com/solutions/2844021

Also make sure the FQDN in the certificate match the hostname in the URL. Shortened name or alias must not be used.