Bug 1448855

Summary:	golden ticket entitlement is not removed when you set contentAccessMode to " " back from "org_environment"
Product:	Red Hat Enterprise Linux 7	Reporter:	Shwetha Kallesh <skallesh>
Component:	subscription-manager	Assignee:	Jiri Hnidek <jhnidek>
Status:	CLOSED ERRATA	QA Contact:	John Sefler <jsefler>
Severity:	high	Docs Contact:
Priority:	high
Version:	7.4	CC:	jhnidek, khowell, redakkan, skallesh
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	subscription-manager-1.19.14-1	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1448897 (view as bug list)		Environment:
Last Closed:	2017-08-01 19:23:41 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Shwetha Kallesh 2017-05-08 12:30:43 UTC

Description of problem:
golden ticket entitlement is not removed when you set contentAccessMode to " " back from "org_environment"

Version-Release number of selected component (if applicable):
[root@bkr-hv01-guest09 ~]# subscription-manager version
server type: Red Hat Subscription Management
subscription management server: 2.1.0-1
subscription management rules: 5.23
subscription-manager: 1.19.12-1.el7
python-rhsm: 1.19.6-1.el7


How reproducible:


Steps to Reproduce:
[root@bkr-hv01-guest09 ~]# curl --stderr /dev/null --insecure --user admin:admin --request PUT --data '{"contentAccessMode":"org_environment"}' --header 'accept: application/json' --header 'content-type: application/json' https://Shwetha-candlepin.usersys.redhat.com:8443/candlepin/owners/snowwhite
{"parentOwner":null,"id":"8ac6a3185be7e537015be7e6284d0002","key":"snowwhite","displayName":"Snow White","contentPrefix":null,"defaultServiceLevel":null,"upstreamConsumer":null,"logLevel":null,"autobindDisabled":null,"contentAccessMode":"org_environment","contentAccessModeList":"org_environment","href":"/owners/snowwhite","created":"2017-05-08T11:51:12+0000","usubscription-manager register --serverurl Shwetha-candlepin.usersys.redhat.com:8443/candlepinRegistering to: Shwetha-candlepin.usersys.redhat.com:8443/candlepin
Username: admin
Password: 
Organization: snowwhite
The system has been registered with ID: 3cdf6e62-b5d1-4797-abae-2d77fafd3a87 
[root@bkr-hv01-guest09 ~]# subscription-manager repos --list-disabled
+----------------------------------------------------------+
    Available Repositories in /etc/yum.repos.d/redhat.repo
+----------------------------------------------------------+
Repo ID:   awesomeos-ia64-only-content
Repo Name: awesomeos-ia64-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-i386-only-content
Repo Name: awesomeos-i386-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   snowy-content-label
Repo Name: snowy-content
Repo URL:  https://cdn.redhat.com/snowwhite/snowy/foo/path
Enabled:   0

Repo ID:   never-enabled-content
Repo Name: never-enabled-content
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path/never
Enabled:   0

Repo ID:   awesomeos-all
Repo Name: awesomeos-all
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-ppc-only-content
Repo Name: awesomeos-ppc-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-x86_64-only-content
Repo Name: awesomeos-x86_64-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-ppc64
Repo Name: awesomeos-ppc64
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/ppc64
Enabled:   0

Repo ID:   awesomeos-s390x
Repo Name: awesomeos-s390x
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/s390x
Enabled:   0

Repo ID:   awesomeos-ia64
Repo Name: awesomeos-ia64
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/ia64
Enabled:   0

Repo ID:   awesomeos-i686
Repo Name: awesomeos-i686
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/i686
Enabled:   0

Repo ID:   awesomeos-x86_64
Repo Name: awesomeos-x86_64
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/x86_64
Enabled:   0

Repo ID:   awesomeos-ppc64-only-content
Repo Name: awesomeos-ppc64-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-s390x-only-content
Repo Name: awesomeos-s390x-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-x86_64-i386-content
Repo Name: awesomeos-x86_64-i386-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   content-label-empty-gpg
Repo Name: content-emptygpg
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path
Enabled:   0

Repo ID:   awesomeos-i386
Repo Name: awesomeos-i386
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/i386
Enabled:   0

Repo ID:   awesomeos-x86
Repo Name: awesomeos-x86
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/$releasever/x86
Enabled:   0

Repo ID:   awesomeos
Repo Name: awesomeos
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/$basearch/$releasever/awesomeos
Enabled:   0

Repo ID:   awesomeos-ppc
Repo Name: awesomeos-ppc
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/ppc
Enabled:   0

Repo ID:   content-label
Repo Name: content
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path
Enabled:   0

Repo ID:   snowy-never-enabled-content
Repo Name: snowy-never-enabled-content
Repo URL:  https://cdn.redhat.com/snowwhite/snowy/foo/path/never
Enabled:   0

Repo ID:   content-label-no-gpg
Repo Name: content-nogpg
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path
Enabled:   0


[root@bkr-hv01-guest09 ~]# curl --stderr /dev/null --insecure --user admin:admin --request PUT --data '{"contentAccessMode":""}' --header 'accept: application/json' --header 'content-type: application/json' https://Shwetha-candlepin.usersys.redhat.com:8443/candlepin/owners/snowwhite
{"parentOwner":null,"id":"8ac6a3185be7e537015be7e6284d0002","key":"snowwhite","displayName":"Snow White","contentPrefix":null,"defaultServiceLevel":null,"upstreamConsumer":null,"logLevel":null,"autobindDisabled":null,"contentAccessMode":null,"contentAccessModeList":"org_environment","href":"/owners/snowwhite","created":"2017-05-08T11:51:12+0000","updated":"2017-05-08T12:06:28+0000"}[root@bkr-hv01-guest09 ~]#  subscription-manager refresh
All local data refreshed
[root@bkr-hv01-guest09 ~]# subscription-manager repos --list-disabled
+----------------------------------------------------------+
    Available Repositories in /etc/yum.repos.d/redhat.repo
+----------------------------------------------------------+
Repo ID:   awesomeos-ia64-only-content
Repo Name: awesomeos-ia64-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-i386-only-content
Repo Name: awesomeos-i386-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   snowy-content-label
Repo Name: snowy-content
Repo URL:  https://cdn.redhat.com/snowwhite/snowy/foo/path
Enabled:   0

Repo ID:   never-enabled-content
Repo Name: never-enabled-content
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path/never
Enabled:   0

Repo ID:   awesomeos-all
Repo Name: awesomeos-all
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-ppc-only-content
Repo Name: awesomeos-ppc-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-x86_64-only-content
Repo Name: awesomeos-x86_64-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-ppc64
Repo Name: awesomeos-ppc64
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/ppc64
Enabled:   0

Repo ID:   awesomeos-s390x
Repo Name: awesomeos-s390x
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/s390x
Enabled:   0

Repo ID:   awesomeos-ia64
Repo Name: awesomeos-ia64
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/ia64
Enabled:   0

Repo ID:   awesomeos-i686
Repo Name: awesomeos-i686
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/i686
Enabled:   0

Repo ID:   awesomeos-x86_64
Repo Name: awesomeos-x86_64
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/x86_64
Enabled:   0

Repo ID:   awesomeos-ppc64-only-content
Repo Name: awesomeos-ppc64-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-s390x-only-content
Repo Name: awesomeos-s390x-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-x86_64-i386-content
Repo Name: awesomeos-x86_64-i386-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   content-label-empty-gpg
Repo Name: content-emptygpg
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path
Enabled:   0

Repo ID:   awesomeos-i386
Repo Name: awesomeos-i386
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/i386
Enabled:   0

Repo ID:   awesomeos-x86
Repo Name: awesomeos-x86
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/$releasever/x86
Enabled:   0

Repo ID:   awesomeos
Repo Name: awesomeos
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/$basearch/$releasever/awesomeos
Enabled:   0

Repo ID:   awesomeos-ppc
Repo Name: awesomeos-ppc
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/ppc
Enabled:   0

Repo ID:   content-label
Repo Name: content
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path
Enabled:   0

Repo ID:   snowy-never-enabled-content
Repo Name: snowy-never-enabled-content
Repo URL:  https://cdn.redhat.com/snowwhite/snowy/foo/path/never
Enabled:   0

Repo ID:   content-label-no-gpg
Repo Name: content-nogpg
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path
Enabled:   0

[root@bkr-hv01-guest09 ~]# subscription-manager list --consumed
No consumed subscription pools to list


Actual results:
golden ticket entitlement is not removed , so repos --list-disabled is not empty


Expected results:
The "golden ticket" entitlement should be removed from the system , so when there are no other subscriptions attached ,repos --list-disabled should be empty

Additional info:

rhsm.log

2017-05-08 08:26:04,665 [INFO] rhsmcertd-worker:31962:MainThread @rhsmcertd-worker:61 - X-Correlation-ID: 815924fdb5754d1da9473f0564702878
2017-05-08 08:26:04,667 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-05-08 08:26:05,960 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:520 - Response: status=200, requestUuid=b2f5187f-7016-40c3-8ea9-7f8a5f0b192f, request="GET /candlepin/"
2017-05-08 08:26:07,425 [INFO] subscription-manager:31967:MainThread @managercli.py:522 - X-Correlation-ID: e7eb10f67f8c4c03a88d9ad131db31c1
2017-05-08 08:26:07,425 [INFO] subscription-manager:31967:MainThread @managercli.py:411 - Client Versions: {'python-rhsm': '1.19.6-1.el7', 'subscription-manager': '1.19.12-1.el7'}
2017-05-08 08:26:07,426 [INFO] subscription-manager:31967:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-05-08 08:26:07,426 [INFO] subscription-manager:31967:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=none
2017-05-08 08:26:07,426 [INFO] subscription-manager:31967:MainThread @managercli.py:386 - Consumer Identity name=bkr-hv01-guest09.dsal.lab.eng.bos.redhat.com uuid=3cdf6e62-b5d1-4797-abae-2d77fafd3a87
2017-05-08 08:26:07,727 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:520 - Response: status=200, requestUuid=4f57eb1f-8e67-471c-9358-bdb83bf65612, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87"
2017-05-08 08:26:08,797 [INFO] subscription-manager:31967:MainThread @connection.py:520 - Response: status=204, requestUuid=17dced75-87dc-4cd2-91d8-b843dad2d684, request="PUT /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/certificates?lazy_regen=true"
2017-05-08 08:26:09,116 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:520 - Response: status=200, requestUuid=f03dc892-f076-4c1d-9adf-5672cd844569, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/compliance"
2017-05-08 08:26:09,120 [INFO] rhsmcertd-worker:31962:MainThread @cert_sorter.py:205 - Product status: valid_products= partial_products= expired_products= unentitled_producs= future_products= valid_until=None
2017-05-08 08:26:09,121 [WARNING] rhsmcertd-worker:31962:MainThread @healinglib.py:114 - Got valid status from server but no valid until date.
2017-05-08 08:26:09,122 [INFO] rhsmcertd-worker:31962:MainThread @healinglib.py:131 - Entitlement auto healing was checked and entitlements are valid today 2017-05-08 12:26:07.728382+00:00
2017-05-08 08:26:09,122 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-05-08 08:26:10,504 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:520 - Response: status=200, requestUuid=dbdaf6af-4086-44ed-8d9c-7ed522186f3e, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/certificates/serials"
2017-05-08 08:26:10,505 [INFO] rhsmcertd-worker:31962:MainThread @entcertlib.py:130 - certs updated:
Total updates: 0
Found (local) serial# []
Expected (UEP) serial# []
Added (new)
  <NONE>
Deleted (rogue):
  <NONE>
2017-05-08 08:26:11,803 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:520 - Response: status=200, requestUuid=8a24af6b-2a10-48e3-b084-957ad565716e, request="GET /candlepin/status"
2017-05-08 08:26:13,190 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:520 - Response: status=400, requestUuid=12cab6bb-64f0-43a4-aa32-7657cf5e16fb, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/accessible_content"
2017-05-08 08:26:13,191 [WARNING] rhsmcertd-worker:31962:MainThread @cache.py:578 - Unable to query for content access updates
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/subscription_manager/cache.py", line 576, in _query_for_update
    response = uep.getAccessibleContent(self.identity.uuid, if_modified_since=if_modified_since)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 1125, in getAccessibleContent
    return self.conn.request_get(method, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 614, in request_get
    return self._request("GET", method, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 640, in _request
    info=info, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 529, in _request
    self.validateResponse(result, request_type, handler)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 578, in validateResponse
    raise RestlibException(response['status'], error_msg, response.get('headers'))
RestlibException: No content access mode assigned
2017-05-08 08:26:14,694 [INFO] subscription-manager:31967:MainThread @connection.py:520 - Response: status=200, requestUuid=145399ac-5343-499d-8b7d-fd6327526848, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/certificates/serials"
2017-05-08 08:26:14,695 [INFO] subscription-manager:31967:MainThread @entcertlib.py:130 - certs updated:
Total updates: 0
Found (local) serial# []
Expected (UEP) serial# []
Added (new)
  <NONE>
Deleted (rogue):
  <NONE>
2017-05-08 08:26:15,988 [INFO] subscription-manager:31967:MainThread @connection.py:520 - Response: status=200, requestUuid=56e8bd98-6901-47a1-8e54-9460df15c5c3, request="GET /candlepin/status"
2017-05-08 08:26:17,488 [INFO] subscription-manager:31967:MainThread @connection.py:520 - Response: status=400, requestUuid=c4a3f96c-63c8-488b-ba92-5305bae7954c, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/accessible_content"
2017-05-08 08:26:17,489 [WARNING] subscription-manager:31967:MainThread @cache.py:578 - Unable to query for content access updates
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/subscription_manager/cache.py", line 576, in _query_for_update
    response = uep.getAccessibleContent(self.identity.uuid, if_modified_since=if_modified_since)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 1125, in getAccessibleContent
    return self.conn.request_get(method, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 614, in request_get
    return self._request("GET", method, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 640, in _request
    info=info, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 529, in _request
    self.validateResponse(result, request_type, handler)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 578, in validateResponse
    raise RestlibException(response['status'], error_msg, response.get('headers'))
RestlibException: No content access mode assigned
2017-05-08 08:26:17,490 [INFO] subscription-manager:31967:MainThread @managercli.py:703 - Refreshed local data
2017-05-08 08:26:18,861 [INFO] subscription-manager:31967:MainThread @connection.py:520 - Response: status=200, requestUuid=ae1ff22b-d81a-41f4-a621-9020787f6cb7, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/compliance"
2017-05-08 08:26:18,862 [INFO] subscription-manager:31967:MainThread @cert_sorter.py:205 - Product status: valid_products= partial_products= expired_products= unentitled_producs= future_products= valid_until=None
2017-05-08 08:26:18,916 [INFO] rhsmd:31902:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-05-08 08:26:20,313 [INFO] rhsmd:31902:MainThread @connection.py:520 - Response: status=200, requestUuid=2ead2d34-a51c-4404-80f6-b49d99200d62, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/compliance"
2017-05-08 08:26:20,333 [INFO] rhsmd:31902:MainThread @cert_sorter.py:205 - Product status: valid_products= partial_products= expired_products= unentitled_producs= future_products= valid_until=None
2017-05-08 08:28:04,775 [INFO] rhsmcertd-worker:31976:MainThread @rhsmcertd-worker:61 - X-Correlation-ID: 8a00f69acf83440dbed0906256ba9516
2017-05-08 08:28:04,777 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-05-08 08:28:06,119 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:520 - Response: status=200, requestUuid=bf86db39-3d01-4c6e-9669-afc6af503e16, request="GET /candlepin/"
2017-05-08 08:28:07,885 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:520 - Response: status=200, requestUuid=dfe4437d-2eb6-47ea-8bfe-6e992585a169, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87"
2017-05-08 08:28:09,275 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:520 - Response: status=200, requestUuid=e3268451-bcf1-4b9a-81c0-924fba701a2d, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/compliance"
2017-05-08 08:28:09,278 [INFO] rhsmcertd-worker:31976:MainThread @cert_sorter.py:205 - Product status: valid_products= partial_products= expired_products= unentitled_producs= future_products= valid_until=None
2017-05-08 08:28:09,279 [WARNING] rhsmcertd-worker:31976:MainThread @healinglib.py:114 - Got valid status from server but no valid until date.
2017-05-08 08:28:09,279 [INFO] rhsmcertd-worker:31976:MainThread @healinglib.py:131 - Entitlement auto healing was checked and entitlements are valid today 2017-05-08 12:28:07.886849+00:00
2017-05-08 08:28:09,280 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-05-08 08:28:10,679 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:520 - Response: status=200, requestUuid=dc640380-22d8-446d-9709-b203fc4560d9, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/certificates/serials"
2017-05-08 08:28:10,680 [INFO] rhsmcertd-worker:31976:MainThread @entcertlib.py:130 - certs updated:
Total updates: 0
Found (local) serial# []
Expected (UEP) serial# []
Added (new)
  <NONE>
Deleted (rogue):
  <NONE>
2017-05-08 08:28:11,977 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:520 - Response: status=200, requestUuid=a3881859-ab18-4106-aad3-94b8fc98113c, request="GET /candlepin/status"
2017-05-08 08:28:13,371 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:520 - Response: status=400, requestUuid=69923d5c-c623-4ead-847f-b94992ac0a17, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/accessible_content"
2017-05-08 08:28:13,372 [WARNING] rhsmcertd-worker:31976:MainThread @cache.py:578 - Unable to query for content access updates
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/subscription_manager/cache.py", line 576, in _query_for_update
    response = uep.getAccessibleContent(self.identity.uuid, if_modified_since=if_modified_since)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 1125, in getAccessibleContent
    return self.conn.request_get(method, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 614, in request_get
    return self._request("GET", method, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 640, in _request
    info=info, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 529, in _request
    self.validateResponse(result, request_type, handler)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 578, in validateResponse
    raise RestlibException(response['status'], error_msg, response.get('headers'))
RestlibException: No content access mode assigned

Comment 2 Kevin Howell 2017-05-08 14:38:02 UTC

First question is why isn't the content access cert removed on refresh. I suspect this is the root cause of the issue in subscription-manager.

Comment 4 Shwetha Kallesh 2017-05-18 10:00:54 UTC

Marking verified!!


[root@dhcp71-112 ~]# subscription-manager version
server type: Red Hat Subscription Management
subscription management server: 0.9.51.23-1
subscription management rules: 5.15.1
subscription-manager: 1.19.14-1.el7
python-rhsm: 1.19.6-1.el7


[root@dhcp71-112 ~]# subscription-manager register --force --serverurl Shwetha-candlepin.usersys.redhat.com:8443/candlepin
Registering to: Shwetha-candlepin.usersys.redhat.com:8443/candlepin
Username: admin
Password: 
Organization: snowwhite
The system has been registered with ID: 19b9dfac-00c6-4ba8-8cc7-0a831fa41b6e 

[root@dhcp71-112 ~]# rct cat-cert /etc/pki/entitlement/8149841718942640303.pem --no-products --no-content 

+-------------------------------------------+
	Entitlement Certificate
+-------------------------------------------+

Certificate:
	Path: /etc/pki/entitlement/8149841718942640303.pem
	Version: 3.3
	Serial: 8149841718942640303
	Start Date: 2017-05-18 08:55:29+00:00
	End Date: 2018-05-18 08:55:29+00:00
	Pool ID: Not Available

Subject:
	CN: 19b9dfac-00c6-4ba8-8cc7-0a831fa41b6e
	O: snowwhite

Issuer:
	C: US
	CN: Shwetha-candlepin.usersys.redhat.com
	L: Raleigh


Order:
	Name: Content Access
	Number: 
	SKU: content_access
	Contract: 
	Account: 
	Service Level: 
	Service Type: 
	Quantity: 
	Quantity Used: 1
	Socket Limit: 
	RAM Limit: 
	Core Limit: 
	Virt Only: False
	Stacking ID: 
	Warning Period: 0
	Provides Management: False

[root@dhcp71-112 ~]# curl --stderr /dev/null --insecure --user admin:admin --request PUT --data '{"contentAccessMode":""}' --header 'accept: application/json' --header 'content-type: application/json' https://Shwetha-candlepin.usersys.redhat.com:8443/candlepin/owners/snowwhite
{"parentOwner":null,"id":"8ac6a3185c0c3e24015c0c41c4520002","key":"snowwhite","displayName":"Snow White","contentPrefix":null,"defaultServiceLevel":null,"upstreamConsumer":null,"logLevel":null,"autobindDisabled":null,"contentAccessMode":null,"contentAccessModeList":"org_environment","href":"/owners/snowwhite","created":"2017-05-15T13:17:35+0000","updated":"2017-05-18T09:57:05+0000"}


[root@dhcp71-112 ~]#  subscription-manager refresh
1 local certificate has been deleted.
All local data refreshed


[root@dhcp71-112 ~]# ls /etc/pki/entitlement/
[root@dhcp71-112 ~]# subscription-manager repos --list
This system has no repositories available through subscriptions.

[root@dhcp71-112 ~]# rct cat-cert /etc/pki/entitlement/8149841718942640303.pem --no-products --no-content The specified certificate file does not exist.

Comment 5 errata-xmlrpc 2017-08-01 19:23:41 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2083