Bug 844386

Summary: [rhevm-webadmin] - Webadmin - Port 80 (http) should be blocked for http://ip/webadmin access
Product: Red Hat Enterprise Virtualization Manager Reporter: David Botzer <dbotzer>
Component: ovirt-engine-webadmin-portalAssignee: Alon Bar-Lev <alonbl>
Status: CLOSED CURRENTRELEASE QA Contact: Tomas Dosek <tdosek>
Severity: medium Docs Contact:
Priority: urgent    
Version: 3.1.0CC: dyasny, ecohen, iheim, knesenko, mgoldboi, oschreib, pstehlik, Rhev-m-bugs, sgrinber, tdosek, ykaul
Target Milestone: ---Keywords: Regression
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: integration
Fixed In Version: si15 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-12-04 20:06:14 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description David Botzer 2012-07-30 13:04:47 UTC 
Description of problem:
The port 80 webadmin access should be blocked

Version-Release number of selected component (if applicable):
3.1/si12

How reproducible:
always

Steps to Reproduce:
1.install rhevm
2.Connect to rhevm using the link - http://ip:<http port>/webadmin
  
Actual results:
Aloow access using http to webadmin

Expected results:
Should be blocked
User should be allowed to welcome page (Portal) and from redirect to webadmin via SSL

Additional info:
Comment 1 Itamar Heim 2012-07-31 11:18:48 UTC 
webadmin, userportal, api and reports should require ssl.
need to handle both apache and no apache use cases (or always use apache).
Comment 3 Ofer Schreiber 2012-07-31 14:49:11 UTC 
service side fix available at http://gerrit.ovirt.org/#/c/6795/1

Engine side fix still needed.
Comment 4 Itamar Heim 2012-08-02 10:38:50 UTC 
*** Bug 834421 has been marked as a duplicate of this bug. ***
Comment 5 Alon Bar-Lev 2012-08-06 20:40:13 UTC 
Engine side is available at[1].

[1] http://gerrit.ovirt.org/#/c/6827/
Comment 7 Tomas Dosek 2012-08-24 10:28:55 UTC 
Veirified - si15 - standard http port is now redirected automatically to https while connecting to webadmin. When trying to wget webadmin on port 80 result is 302 Moved temporararily and redirection to https