Bug 1828549

Description of problem:

User with only "Discover Reader" role enabled, is able to get private key for manifest/organization when they authenitcate to the Satellite WEb UI, and then manually navigate to this endpoint:

  http://satellite.example.com/katello/api/v2/organizations/1 

A json output is printed to the screen which includes the private and public key for what I believe is the manifest associated with that organization.  I have grabbed part of the json, and removed the public and private certs, and also hanged the org name and manifest name to ORGANIZATION-NAME and MANIFEST-NAME respectively:

    "name": "ORGANIZATION-NAME",
   "owner_details": {
       "autobindDisabled": false,
       "contentAccessMode": "entitlement",
       "contentAccessModeList": "entitlement",
       "contentPrefix": "/ORGANIZATION-NAME/$env",
       "created": "2020-04-03T16:16:09+0000",
       "defaultServiceLevel": null,
       "displayName": "ORGANIZATION-NAME",
       "href": "/owners/ORGANIZATION-NAME",
       "id": "8a8080887140d389017140d4085f0001",
       "key": "ORGANIZATION-NAME",
       "lastRefreshed": "2020-04-04T00:04:44+0000",
       "logLevel": null,
       "parentOwner": null,
       "updated": "2020-04-04T00:04:44+0000",
       "upstreamConsumer": {
           "apiUrl": "https://subscription.rhsm.redhat.com/subscription/consumers/",
           "contentAccessMode": null,
           "created": "2020-04-04T00:04:28+0000",
           "id": "8a8080887140d38901714280c81a005d",
           "idCert": {
               "cert": "-----BEGIN CERTIFICATE----***REMOVED***-----END CERTIFICATE-----\n",
               "created": "2020-04-03T23:51:05+0000",
               "id": "8a8080887140d38901714280c80e005c",
               "key": "-----BEGIN RSA PRIVATE KEY----***REMOVED***-----END RSA PRIVATE KEY-----\n",
               "serial": {
                   "collected": false,
                   "created": "2020-04-03T23:51:05+0000",
                   "expiration": "2021-04-03T23:51:05+0000",
                   "id": 6867080507192518295,
                   "revoked": false,
                   "serial": 6867080507192518295,
                   "updated": "2020-04-04T00:04:28+0000"
               },
               "updated": "2020-04-04T00:04:28+0000"
           },
           "name": "MANIFEST-NAME",
           "ownerId": "8a8080887140d389017140d4085f0001",
           "type": {
               "id": "8a8080887140d38901714280c7640006",
               "label": "satellite",
               "manifest": true
           },
           "updated": "2020-04-04T00:04:28+0000",
           "uuid": "4aa39171-de7c-4936-bfd9-b06b27000581",
           "webUrl": "access.redhat.com/management/subscription_allocations/"
       },
       "virt_who": true
   },
Version-Release number of selected component (if applicable):
Satellite 6.6.2-1

How reproducible:
Always

Steps to Reproduce:
1. Create user with "Discover Reader" role
2. Have that user log in to the Satellite Web UI
3. Open a new tab, and manually navigate to https://satellite.example.com/katello/api/v2/organizations/1

Actual results:
Private and public key are exposed to end user

Expected results:
User should see private and public key.  Also, private key should not be exposed.

Additional info: