Bug 1165403
| Summary: | Deprecate the cacert and cakey settings in server.conf | ||
|---|---|---|---|
| Product: | [Retired] Pulp | Reporter: | Randy Barlow <rbarlow> |
| Component: | API/integration | Assignee: | pulp-bugs |
| Status: | CLOSED UPSTREAM | QA Contact: | pulp-qe-list |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 2.4.0 | CC: | jortel, skarmark |
| Target Milestone: | --- | Keywords: | Triaged |
| Target Release: | 3.0.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-02-28 22:44:49 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1165405 | ||
Deprecate. Deprecates in https://github.com/pulp/pulp/pull/1512, but not moving to POST, since this will be moved to target release 3.0 after review and merge of the above PR. Merged above PR. Moving to 3.0. Moved to https://pulp.plan.io/issues/621 |
Description of problem: The cacert and cakey settings in server.conf are currently used to configure Pulp to use a CA for signing client certificates generated by Pulp. These settings often confuse our users, as they tend to think it should be the CA that signed the httpd SSL certificates. In addition, it is far from ideal that our /login/ API call generates the secret key, certificate, and signature and sends those to the client. This violates the principle that the key should never be transmitted. We have two viable options: 1) Rename these settings to be more descriptive so that they don't confuse users. Something like client_auth_ca{cert,key} might make sense. If we do this, the client should generate the secret key and a CSR, and send that CSR with their credentials to the /login/ call. Then the server signs the CSR and sends back the certificate. 2) Get out of the business of signing certificates entirely, and change /login/ to return a session key or something along those lines. Of course, continue to support client certificates that are generated by users on both ends (through Apache and pulp-admin). Either way, we need to put a deprecation on these two settings so that people know they are going away ahead of time. This bug is not about changing the /login/ behavior, it is about depreacating these two settings. Version-Release number of selected component (if applicable): 2.4.0-1 How reproducible: Every time. Steps to Reproduce: 1. Does Pulp have these settings in server.conf? Actual results: Yes. Expected results: No.