Bug 971121

Summary:	Candlepin Lists Derived Pools For Distributors
Product:	[Community] Candlepin	Reporter:	Devan Goodwin <dgoodwin>
Component:	candlepin	Assignee:	William Poteat <wpoteat>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Katello QA List <katello-qa-list>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	0.9	CC:	jesusr, jsefler, wpoteat
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-10-01 13:48:27 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	840995

Description Devan Goodwin 2013-06-05 18:19:38 UTC

Description of problem:

When listing pools for a distributor, derived (sub) pools are showing up, then erroring out when the user tries to bind.

Version-Release number of selected component (if applicable):

candlepin-0.8.12-1


Steps to Reproduce:
1. Bind to a virt_limit or instance based pool to create a sub-pool.
2. Create a distrubitor.
3. List pools for that distributor. (GET /owners/admin/pools?consumer=UUID)


Actual results:

You will see derived pools in this list. 

Expected results:

You should not see derived pools in this list.

Additional info:

Due to a miscommunication when recent work was done to *allow* us to show pools during list but error out on bind, several pre-existing errors were automatically changed to do this, when they should have been errors no matter what.

Derived pools are not fit for export so should not be visible at all.

In fixing, we also need to re-examine all other cases like this to make sure distributors need to be able to see the subscription in a list, but be told why they can't use it when they try to bind. 

An example of where this is correctly used would be instance subscriptions when the distributor is too old to enforce them.

Comment 1 William Poteat 2013-06-12 13:24:43 UTC

master commit 83c4936edf20804d42ed1f3174d49dcd21f8d749

Comment 2 John Sefler 2013-07-22 22:34:31 UTC

Verifying with versions...
[root@jsefler-f14-candlepin candlepin]# git show-ref | grep master | head -1
57ac1f8da3ad1abe463a5ec6179813bf707daa35 refs/heads/master
[root@jsefler-5 ~]# subscription-manager version
server type: This system is currently not registered.
subscription management server: 0.8.16-1
subscription-manager: 1.8.13-1.el5
python-rhsm: 1.8.13-1.el5


My approach to verifying this will be to use candlepin deployed with the TESTDATA and then...
1. register a type=system consumer and take note of all the available pools that are actually derived.
2. then register as type=candlepin using the same credentials and take note of all the available pools.
assert that the derived pools available to the system consumer are NOT available to the candlepin consumer.


Step 1.
[root@jsefler-5 ~]# subscription-manager register --username=testuser1 --password=password --org=admin --type=system --force
The system has been registered with ID: bb6b4189-1b75-4215-b4e9-bef04e70fd7c 
[root@jsefler-5 ~]# curl -stderr /dev/null -k -u testuser1:password https://jsefler-f14-candlepin.usersys.redhat.com:8443/candlepin/owners/admin/pools?consumer=bb6b4189-1b75-4215-b4e9-bef04e70fd7c | python -m simplejson/tool | egrep "^        \"subscriptionSubKey\"|^        \"id\"|^        \"productName\"" | grep derived -B2
        "id": "8a90f8203fc4ca73013fc4cc6c650759", 
        "productName": "Awesome OS with unlimited virtual guests", 
        "subscriptionSubKey": "derived", 
--
        "id": "8a90f8203fc4ca73013fc4cbf4f10705", 
        "productName": "Awesome OS with up to 4 virtual guests", 
        "subscriptionSubKey": "derived", 
--
        "id": "8a90f8203fc4ca73013fc4cbf51e071b", 
        "productName": "Awesome OS with up to 4 virtual guests", 
        "subscriptionSubKey": "derived", 
--
        "id": "8a90f8203fc4ca73013fc4cbf5820746", 
        "productName": "Awesome OS with unlimited virtual guests", 
        "subscriptionSubKey": "derived", 
[root@jsefler-5 ~]# 
Note that these four pools are all derived and available to a system user in the org admin.


Step 2.
[root@jsefler-5 ~]# subscription-manager register --username=testuser1 --password=password --org=admin --type=candlepin --force
The system with UUID bb6b4189-1b75-4215-b4e9-bef04e70fd7c has been unregistered
The system has been registered with ID: 25a8c4a2-83ee-48f0-84a8-a42a3ea044c2 
[root@jsefler-5 ~]# curl -stderr /dev/null -k -u testuser1:password https://jsefler-f14-candlepin.usersys.redhat.com:8443/candlepin/owners/admin/pools?consumer=25a8c4a2-83ee-48f0-84a8-a42a3ea044c2 | python -m simplejson/tool | egrep "^        \"subscriptionSubKey\"|^        \"id\"|^        \"productName\"" | grep derived -B2
[root@jsefler-5 ~]# 

^That empty reply is enough to verify that the derived pools are not available to the candlepin consumer.

Moving bugzilla to VERIFIED





We could also verify it in reverse like this...
Step 2.
[root@jsefler-5 ~]# subscription-manager list --avail --all | egrep "8a90f8203fc4ca73013fc4cc6c650759|8a90f8203fc4ca73013fc4cbf4f10705|8a90f8203fc4ca73013fc4cbf51e071b|8a90f8203fc4ca73013fc4cbf5820746" 
[root@jsefler-5 ~]# 

^That empty list verifies that the known derived pools are not available to the candlepin consumer while...

Step 1.
[root@jsefler-5 ~]# subscription-manager register --username=testuser1 --password=password --org=admin --type=system --force
The system with UUID 25a8c4a2-83ee-48f0-84a8-a42a3ea044c2 has been unregistered
The system has been registered with ID: 63ea25bf-38d4-4884-8999-4473e5ae894b 
[root@jsefler-5 ~]# subscription-manager list --avail --all | egrep "8a90f8203fc4ca73013fc4cc6c650759|8a90f8203fc4ca73013fc4cbf4f10705|8a90f8203fc4ca73013fc4cbf51e071b|8a90f8203fc4ca73013fc4cbf5820746" 
Pool ID:           8a90f8203fc4ca73013fc4cc6c650759
Pool ID:           8a90f8203fc4ca73013fc4cbf4f10705
Pool ID:           8a90f8203fc4ca73013fc4cbf51e071b
Pool ID:           8a90f8203fc4ca73013fc4cbf5820746
[root@jsefler-5 ~]# 

^ That list of four known derived pools is available to a system consumer.