Bug 892990

Summary: The server address should not be "localhost" on user account info page
Product: OpenShift Container Platform Reporter: xjia <xjia>
Component: WebsiteAssignee: Brenton Leanhardt <bleanhar>
Status: CLOSED ERRATA QA Contact: libra bugs <libra-bugs>
Severity: medium Docs Contact:
Priority: medium    
Version: 1.2.0CC: bleanhar, jialiu, libra-onpremise-devel, xtian
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-01-31 20:34:32 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description xjia 2013-01-08 11:52:04 UTC
Description of problem:
When I access thhe account info page "https://broker.example.com/console/account", it shows that:
Personal Information:
You are authenticated to the server localhost with the login jia.
The server name should not be "localhost".

Walk around:
Firstly: Modify "BROKER_URL=http://broker.example.com:8080/broker/rest" in /etc/openshift/console.conf
Second: Modify "Listen 0.0.0.0:8080" in /var/www/openshift/broker/httpd/broker.conf
Thirdly: lokkit --port=8080:tcp
Finally: restart openshift-broker and openshift-console service.

Version-Release number of selected component (if applicable):
http://buildvm-devops.usersys.redhat.com/puddle/build/OpenShiftEnterprise/1.1.x/2013-01-07.2/

How reproducible:
always

Steps to Reproduce:
1.Visit user's account info page

Actual results:
You are authenticated to the server localhost with the login jia.

Expected results:
You are authenticated to the server broker.example.com with the login jia.
Should not "localhost"

Comment 2 Brenton Leanhardt 2013-01-08 18:15:34 UTC
Here's another way to workaround the problem.  In /etc/openshift/console.conf:

BROKER_URL=http://broker.example.com:8080/broker/rest
BROKER_PROXY_URL=http://localhost:8080/broker/rest

That appeared to work on my install.  We should probably consider updating our documentation if this is sufficient.

Comment 3 Brenton Leanhardt 2013-01-08 18:39:32 UTC
We talked a little bit about this offline.  We'd prefer _not_ to do any sort of configuration hacks because the configuration is already complicated enough as it is.

In Enterprise the connection between the console and the broker must happen via directly to 127.0.0.1:8080 we are trusting the connection and passing the authentication straight through.

We're considering removing the text 'to the server <strong>#{RestApi.site.host}</strong>' from app/views/account/_user.html.haml.

Comment 4 Clayton Coleman 2013-01-08 18:51:32 UTC
I'm ambivalent - this is fine for enterprise in a specific config.  It might make sense to instead change the code to

['127.0.0.1', 'localhost'].include?(RestApi.site.host) ? request.host : RestApi.site.host

You'll have to check request.host, this may not work from a view.  The idea is to use the current web host if the broker is set to loopback.

Comment 5 Brenton Leanhardt 2013-01-08 19:25:54 UTC
I've created Bug #893172 for us to allow console and broker to securely live on separate hosts.  At that time we'll readdress this issue.  For now we're going to solve this in Enterprise as Clayton suggests.

Comment 6 Brenton Leanhardt 2013-01-08 20:56:00 UTC
This will ship with the next 1.1 puddle.

Comment 7 xjia 2013-01-09 05:37:51 UTC
Verify:
You are authenticated to the server broker.example.com with the login jia.
Version:
http://buildvm-devops.usersys.redhat.com/puddle/build/OpenShiftEnterprise/1.1.x/2013-01-08.1/

Comment 9 errata-xmlrpc 2013-01-31 20:34:32 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2013-0220.html