Bug 738762

Summary:	API is not supporting identity certificates
Product:	Red Hat Satellite	Reporter:	Bryan Kearney <bkearney>
Component:	API	Assignee:	Ivan Necas <inecas>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Jitendra Yejare <jyejare>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.0.1	CC:	inecas
Target Milestone:	Unspecified
Target Release:	Unused
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-08-22 17:57:03 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	747354

Description Bryan Kearney 2011-09-15 18:15:27 UTC

Got alot further this time on the basic patch management stories. Latets issue is because of certifiates. 

If i register a consumer, it uses basic auth. Future calls use an identity certificate. Here is an example.

Register a machine using subscription manager. Assume the machines UUID is now:

a7a248fd-9c53-4b01-b4ee-cb83f5469bb0


the following command will work:

sudo curl -k --user "admin:admin"  https://10.11.230.185/katello/api/consumers/a7a248fd-9c53-4b01-b4ee-cb83f5469bb0


the following will not

sudo curl -k --cert /etc/pki/consumer/cert.pem --key /etc/pki/consumer/key.pem  https://10.11.230.185/katello/api/consumers/a7a248fd-9c53-4b01-b4ee-cb83f5469bb0


The identity ceritifcate carries the ID of the consumer and needs to be extracted. Both calls should have worked.

-- bk

Comment 1 Ivan Necas 2011-09-16 15:40:33 UTC

The problem was that apache,that provides ssl layer for katello now, wasn't configured to perform SSL client verification. I've set it up in commit 4c1e2ac05156174f51d479d2f26845a84f9d3905 .

It's configured in a way, that apache performs the certificate verification and then sends the SSL_CLIENT_CERT to the thin for katello to be able to do authorization.t

The registrations works fine (the system is created together with creating consumers in cp and pulp). 

Another problem occured when subscription-manager tried to send package profile. We were getting the following message from apache:

413 Request        Entity Too Large
The requested resource /katello/api/consumers/bb9493e3-43f8-8a35-66cd2154aeb     d/packages does not allow request data with PUT requests, or the amount of        data provided in\nthe request exceeds the capacity limit.

For default, there is limitation for the SSL verified requests to 128KB see [1]. After changing SSLRenegBufferSize to 262144 (coommit 1a00e4cb9f08cf2abea36bfb23a6a24d59ff0ca6) the registration works together with sending the package profile.

However this limitation might be a problem in future, and we should be aware of it.

As part of debugging, I've also fixed a problems with proxy requests related to changes of our API path to /katello/api. (commit f66825ede9c9503cd9bd2784c94f8e16d65ff7be)

[1] - https://issues.apache.org/bugzilla/show_bug.cgi?id=39243

Comment 2 Jeff Weiss 2011-09-28 15:17:27 UTC

Verified, katello-0.1.85-1.git.45.c6e1331.fc14.noarch

Comment 5 Mike McCune 2013-08-16 18:07:04 UTC

getting rid of 6.0.0 version since that doesn't exist