RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1448855 - golden ticket entitlement is not removed when you set contentAccessMode to " " back from "org_environment"
Summary: golden ticket entitlement is not removed when you set contentAccessMode to " ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: subscription-manager
Version: 7.4
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: rc
: ---
Assignee: Jiri Hnidek
QA Contact: John Sefler
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-05-08 12:30 UTC by Shwetha Kallesh
Modified: 2017-08-01 19:23 UTC (History)
4 users (show)

Fixed In Version: subscription-manager-1.19.14-1
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1448897 (view as bug list)
Environment:
Last Closed: 2017-08-01 19:23:41 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github candlepin subscription-manager pull 1624 0 'None' closed 1448855: golden ticket entitlement was not removed. 2020-12-22 00:59:38 UTC
Red Hat Bugzilla 1448897 0 high CLOSED owner allowed unsetting contentAccessMode when contentAccessModeList did not contain "entitlement" 2021-02-22 00:41:40 UTC
Red Hat Product Errata RHBA-2017:2083 0 normal SHIPPED_LIVE python-rhsm and subscription-manager bug fix and enhancement update 2017-08-01 18:14:19 UTC

Internal Links: 1448897

Description Shwetha Kallesh 2017-05-08 12:30:43 UTC 
Description of problem:
golden ticket entitlement is not removed when you set contentAccessMode to " " back from "org_environment"

Version-Release number of selected component (if applicable):
[root@bkr-hv01-guest09 ~]# subscription-manager version
server type: Red Hat Subscription Management
subscription management server: 2.1.0-1
subscription management rules: 5.23
subscription-manager: 1.19.12-1.el7
python-rhsm: 1.19.6-1.el7


How reproducible:


Steps to Reproduce:
[root@bkr-hv01-guest09 ~]# curl --stderr /dev/null --insecure --user admin:admin --request PUT --data '{"contentAccessMode":"org_environment"}' --header 'accept: application/json' --header 'content-type: application/json' https://Shwetha-candlepin.usersys.redhat.com:8443/candlepin/owners/snowwhite
{"parentOwner":null,"id":"8ac6a3185be7e537015be7e6284d0002","key":"snowwhite","displayName":"Snow White","contentPrefix":null,"defaultServiceLevel":null,"upstreamConsumer":null,"logLevel":null,"autobindDisabled":null,"contentAccessMode":"org_environment","contentAccessModeList":"org_environment","href":"/owners/snowwhite","created":"2017-05-08T11:51:12+0000","usubscription-manager register --serverurl Shwetha-candlepin.usersys.redhat.com:8443/candlepinRegistering to: Shwetha-candlepin.usersys.redhat.com:8443/candlepin
Username: admin
Password: 
Organization: snowwhite
The system has been registered with ID: 3cdf6e62-b5d1-4797-abae-2d77fafd3a87 
[root@bkr-hv01-guest09 ~]# subscription-manager repos --list-disabled
+----------------------------------------------------------+
    Available Repositories in /etc/yum.repos.d/redhat.repo
+----------------------------------------------------------+
Repo ID:   awesomeos-ia64-only-content
Repo Name: awesomeos-ia64-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-i386-only-content
Repo Name: awesomeos-i386-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   snowy-content-label
Repo Name: snowy-content
Repo URL:  https://cdn.redhat.com/snowwhite/snowy/foo/path
Enabled:   0

Repo ID:   never-enabled-content
Repo Name: never-enabled-content
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path/never
Enabled:   0

Repo ID:   awesomeos-all
Repo Name: awesomeos-all
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-ppc-only-content
Repo Name: awesomeos-ppc-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-x86_64-only-content
Repo Name: awesomeos-x86_64-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-ppc64
Repo Name: awesomeos-ppc64
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/ppc64
Enabled:   0

Repo ID:   awesomeos-s390x
Repo Name: awesomeos-s390x
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/s390x
Enabled:   0

Repo ID:   awesomeos-ia64
Repo Name: awesomeos-ia64
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/ia64
Enabled:   0

Repo ID:   awesomeos-i686
Repo Name: awesomeos-i686
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/i686
Enabled:   0

Repo ID:   awesomeos-x86_64
Repo Name: awesomeos-x86_64
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/x86_64
Enabled:   0

Repo ID:   awesomeos-ppc64-only-content
Repo Name: awesomeos-ppc64-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-s390x-only-content
Repo Name: awesomeos-s390x-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-x86_64-i386-content
Repo Name: awesomeos-x86_64-i386-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   content-label-empty-gpg
Repo Name: content-emptygpg
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path
Enabled:   0

Repo ID:   awesomeos-i386
Repo Name: awesomeos-i386
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/i386
Enabled:   0

Repo ID:   awesomeos-x86
Repo Name: awesomeos-x86
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/$releasever/x86
Enabled:   0

Repo ID:   awesomeos
Repo Name: awesomeos
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/$basearch/$releasever/awesomeos
Enabled:   0

Repo ID:   awesomeos-ppc
Repo Name: awesomeos-ppc
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/ppc
Enabled:   0

Repo ID:   content-label
Repo Name: content
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path
Enabled:   0

Repo ID:   snowy-never-enabled-content
Repo Name: snowy-never-enabled-content
Repo URL:  https://cdn.redhat.com/snowwhite/snowy/foo/path/never
Enabled:   0

Repo ID:   content-label-no-gpg
Repo Name: content-nogpg
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path
Enabled:   0


[root@bkr-hv01-guest09 ~]# curl --stderr /dev/null --insecure --user admin:admin --request PUT --data '{"contentAccessMode":""}' --header 'accept: application/json' --header 'content-type: application/json' https://Shwetha-candlepin.usersys.redhat.com:8443/candlepin/owners/snowwhite
{"parentOwner":null,"id":"8ac6a3185be7e537015be7e6284d0002","key":"snowwhite","displayName":"Snow White","contentPrefix":null,"defaultServiceLevel":null,"upstreamConsumer":null,"logLevel":null,"autobindDisabled":null,"contentAccessMode":null,"contentAccessModeList":"org_environment","href":"/owners/snowwhite","created":"2017-05-08T11:51:12+0000","updated":"2017-05-08T12:06:28+0000"}[root@bkr-hv01-guest09 ~]#  subscription-manager refresh
All local data refreshed
[root@bkr-hv01-guest09 ~]# subscription-manager repos --list-disabled
+----------------------------------------------------------+
    Available Repositories in /etc/yum.repos.d/redhat.repo
+----------------------------------------------------------+
Repo ID:   awesomeos-ia64-only-content
Repo Name: awesomeos-ia64-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-i386-only-content
Repo Name: awesomeos-i386-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   snowy-content-label
Repo Name: snowy-content
Repo URL:  https://cdn.redhat.com/snowwhite/snowy/foo/path
Enabled:   0

Repo ID:   never-enabled-content
Repo Name: never-enabled-content
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path/never
Enabled:   0

Repo ID:   awesomeos-all
Repo Name: awesomeos-all
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-ppc-only-content
Repo Name: awesomeos-ppc-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-x86_64-only-content
Repo Name: awesomeos-x86_64-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-ppc64
Repo Name: awesomeos-ppc64
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/ppc64
Enabled:   0

Repo ID:   awesomeos-s390x
Repo Name: awesomeos-s390x
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/s390x
Enabled:   0

Repo ID:   awesomeos-ia64
Repo Name: awesomeos-ia64
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/ia64
Enabled:   0

Repo ID:   awesomeos-i686
Repo Name: awesomeos-i686
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/i686
Enabled:   0

Repo ID:   awesomeos-x86_64
Repo Name: awesomeos-x86_64
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/x86_64
Enabled:   0

Repo ID:   awesomeos-ppc64-only-content
Repo Name: awesomeos-ppc64-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-s390x-only-content
Repo Name: awesomeos-s390x-only-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   awesomeos-x86_64-i386-content
Repo Name: awesomeos-x86_64-i386-content
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/all
Enabled:   0

Repo ID:   content-label-empty-gpg
Repo Name: content-emptygpg
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path
Enabled:   0

Repo ID:   awesomeos-i386
Repo Name: awesomeos-i386
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/i386
Enabled:   0

Repo ID:   awesomeos-x86
Repo Name: awesomeos-x86
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/$releasever/x86
Enabled:   0

Repo ID:   awesomeos
Repo Name: awesomeos
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/$basearch/$releasever/awesomeos
Enabled:   0

Repo ID:   awesomeos-ppc
Repo Name: awesomeos-ppc
Repo URL:  https://cdn.redhat.com/snowwhite/path/to/awesomeos/ppc
Enabled:   0

Repo ID:   content-label
Repo Name: content
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path
Enabled:   0

Repo ID:   snowy-never-enabled-content
Repo Name: snowy-never-enabled-content
Repo URL:  https://cdn.redhat.com/snowwhite/snowy/foo/path/never
Enabled:   0

Repo ID:   content-label-no-gpg
Repo Name: content-nogpg
Repo URL:  https://cdn.redhat.com/snowwhite/foo/path
Enabled:   0

[root@bkr-hv01-guest09 ~]# subscription-manager list --consumed
No consumed subscription pools to list


Actual results:
golden ticket entitlement is not removed , so repos --list-disabled is not empty


Expected results:
The "golden ticket" entitlement should be removed from the system , so when there are no other subscriptions attached ,repos --list-disabled should be empty

Additional info:

rhsm.log

2017-05-08 08:26:04,665 [INFO] rhsmcertd-worker:31962:MainThread @rhsmcertd-worker:61 - X-Correlation-ID: 815924fdb5754d1da9473f0564702878
2017-05-08 08:26:04,667 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-05-08 08:26:05,960 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:520 - Response: status=200, requestUuid=b2f5187f-7016-40c3-8ea9-7f8a5f0b192f, request="GET /candlepin/"
2017-05-08 08:26:07,425 [INFO] subscription-manager:31967:MainThread @managercli.py:522 - X-Correlation-ID: e7eb10f67f8c4c03a88d9ad131db31c1
2017-05-08 08:26:07,425 [INFO] subscription-manager:31967:MainThread @managercli.py:411 - Client Versions: {'python-rhsm': '1.19.6-1.el7', 'subscription-manager': '1.19.12-1.el7'}
2017-05-08 08:26:07,426 [INFO] subscription-manager:31967:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-05-08 08:26:07,426 [INFO] subscription-manager:31967:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=none
2017-05-08 08:26:07,426 [INFO] subscription-manager:31967:MainThread @managercli.py:386 - Consumer Identity name=bkr-hv01-guest09.dsal.lab.eng.bos.redhat.com uuid=3cdf6e62-b5d1-4797-abae-2d77fafd3a87
2017-05-08 08:26:07,727 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:520 - Response: status=200, requestUuid=4f57eb1f-8e67-471c-9358-bdb83bf65612, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87"
2017-05-08 08:26:08,797 [INFO] subscription-manager:31967:MainThread @connection.py:520 - Response: status=204, requestUuid=17dced75-87dc-4cd2-91d8-b843dad2d684, request="PUT /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/certificates?lazy_regen=true"
2017-05-08 08:26:09,116 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:520 - Response: status=200, requestUuid=f03dc892-f076-4c1d-9adf-5672cd844569, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/compliance"
2017-05-08 08:26:09,120 [INFO] rhsmcertd-worker:31962:MainThread @cert_sorter.py:205 - Product status: valid_products= partial_products= expired_products= unentitled_producs= future_products= valid_until=None
2017-05-08 08:26:09,121 [WARNING] rhsmcertd-worker:31962:MainThread @healinglib.py:114 - Got valid status from server but no valid until date.
2017-05-08 08:26:09,122 [INFO] rhsmcertd-worker:31962:MainThread @healinglib.py:131 - Entitlement auto healing was checked and entitlements are valid today 2017-05-08 12:26:07.728382+00:00
2017-05-08 08:26:09,122 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-05-08 08:26:10,504 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:520 - Response: status=200, requestUuid=dbdaf6af-4086-44ed-8d9c-7ed522186f3e, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/certificates/serials"
2017-05-08 08:26:10,505 [INFO] rhsmcertd-worker:31962:MainThread @entcertlib.py:130 - certs updated:
Total updates: 0
Found (local) serial# []
Expected (UEP) serial# []
Added (new)
  <NONE>
Deleted (rogue):
  <NONE>
2017-05-08 08:26:11,803 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:520 - Response: status=200, requestUuid=8a24af6b-2a10-48e3-b084-957ad565716e, request="GET /candlepin/status"
2017-05-08 08:26:13,190 [INFO] rhsmcertd-worker:31962:MainThread @connection.py:520 - Response: status=400, requestUuid=12cab6bb-64f0-43a4-aa32-7657cf5e16fb, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/accessible_content"
2017-05-08 08:26:13,191 [WARNING] rhsmcertd-worker:31962:MainThread @cache.py:578 - Unable to query for content access updates
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/subscription_manager/cache.py", line 576, in _query_for_update
    response = uep.getAccessibleContent(self.identity.uuid, if_modified_since=if_modified_since)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 1125, in getAccessibleContent
    return self.conn.request_get(method, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 614, in request_get
    return self._request("GET", method, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 640, in _request
    info=info, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 529, in _request
    self.validateResponse(result, request_type, handler)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 578, in validateResponse
    raise RestlibException(response['status'], error_msg, response.get('headers'))
RestlibException: No content access mode assigned
2017-05-08 08:26:14,694 [INFO] subscription-manager:31967:MainThread @connection.py:520 - Response: status=200, requestUuid=145399ac-5343-499d-8b7d-fd6327526848, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/certificates/serials"
2017-05-08 08:26:14,695 [INFO] subscription-manager:31967:MainThread @entcertlib.py:130 - certs updated:
Total updates: 0
Found (local) serial# []
Expected (UEP) serial# []
Added (new)
  <NONE>
Deleted (rogue):
  <NONE>
2017-05-08 08:26:15,988 [INFO] subscription-manager:31967:MainThread @connection.py:520 - Response: status=200, requestUuid=56e8bd98-6901-47a1-8e54-9460df15c5c3, request="GET /candlepin/status"
2017-05-08 08:26:17,488 [INFO] subscription-manager:31967:MainThread @connection.py:520 - Response: status=400, requestUuid=c4a3f96c-63c8-488b-ba92-5305bae7954c, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/accessible_content"
2017-05-08 08:26:17,489 [WARNING] subscription-manager:31967:MainThread @cache.py:578 - Unable to query for content access updates
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/subscription_manager/cache.py", line 576, in _query_for_update
    response = uep.getAccessibleContent(self.identity.uuid, if_modified_since=if_modified_since)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 1125, in getAccessibleContent
    return self.conn.request_get(method, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 614, in request_get
    return self._request("GET", method, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 640, in _request
    info=info, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 529, in _request
    self.validateResponse(result, request_type, handler)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 578, in validateResponse
    raise RestlibException(response['status'], error_msg, response.get('headers'))
RestlibException: No content access mode assigned
2017-05-08 08:26:17,490 [INFO] subscription-manager:31967:MainThread @managercli.py:703 - Refreshed local data
2017-05-08 08:26:18,861 [INFO] subscription-manager:31967:MainThread @connection.py:520 - Response: status=200, requestUuid=ae1ff22b-d81a-41f4-a621-9020787f6cb7, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/compliance"
2017-05-08 08:26:18,862 [INFO] subscription-manager:31967:MainThread @cert_sorter.py:205 - Product status: valid_products= partial_products= expired_products= unentitled_producs= future_products= valid_until=None
2017-05-08 08:26:18,916 [INFO] rhsmd:31902:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-05-08 08:26:20,313 [INFO] rhsmd:31902:MainThread @connection.py:520 - Response: status=200, requestUuid=2ead2d34-a51c-4404-80f6-b49d99200d62, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/compliance"
2017-05-08 08:26:20,333 [INFO] rhsmd:31902:MainThread @cert_sorter.py:205 - Product status: valid_products= partial_products= expired_products= unentitled_producs= future_products= valid_until=None
2017-05-08 08:28:04,775 [INFO] rhsmcertd-worker:31976:MainThread @rhsmcertd-worker:61 - X-Correlation-ID: 8a00f69acf83440dbed0906256ba9516
2017-05-08 08:28:04,777 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-05-08 08:28:06,119 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:520 - Response: status=200, requestUuid=bf86db39-3d01-4c6e-9669-afc6af503e16, request="GET /candlepin/"
2017-05-08 08:28:07,885 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:520 - Response: status=200, requestUuid=dfe4437d-2eb6-47ea-8bfe-6e992585a169, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87"
2017-05-08 08:28:09,275 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:520 - Response: status=200, requestUuid=e3268451-bcf1-4b9a-81c0-924fba701a2d, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/compliance"
2017-05-08 08:28:09,278 [INFO] rhsmcertd-worker:31976:MainThread @cert_sorter.py:205 - Product status: valid_products= partial_products= expired_products= unentitled_producs= future_products= valid_until=None
2017-05-08 08:28:09,279 [WARNING] rhsmcertd-worker:31976:MainThread @healinglib.py:114 - Got valid status from server but no valid until date.
2017-05-08 08:28:09,279 [INFO] rhsmcertd-worker:31976:MainThread @healinglib.py:131 - Entitlement auto healing was checked and entitlements are valid today 2017-05-08 12:28:07.886849+00:00
2017-05-08 08:28:09,280 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:780 - Connection built: host=Shwetha-candlepin.usersys.redhat.com port=8443 handler=/candlepin auth=identity_cert ca_dir=/etc/rhsm/ca/ insecure=False
2017-05-08 08:28:10,679 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:520 - Response: status=200, requestUuid=dc640380-22d8-446d-9709-b203fc4560d9, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/certificates/serials"
2017-05-08 08:28:10,680 [INFO] rhsmcertd-worker:31976:MainThread @entcertlib.py:130 - certs updated:
Total updates: 0
Found (local) serial# []
Expected (UEP) serial# []
Added (new)
  <NONE>
Deleted (rogue):
  <NONE>
2017-05-08 08:28:11,977 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:520 - Response: status=200, requestUuid=a3881859-ab18-4106-aad3-94b8fc98113c, request="GET /candlepin/status"
2017-05-08 08:28:13,371 [INFO] rhsmcertd-worker:31976:MainThread @connection.py:520 - Response: status=400, requestUuid=69923d5c-c623-4ead-847f-b94992ac0a17, request="GET /candlepin/consumers/3cdf6e62-b5d1-4797-abae-2d77fafd3a87/accessible_content"
2017-05-08 08:28:13,372 [WARNING] rhsmcertd-worker:31976:MainThread @cache.py:578 - Unable to query for content access updates
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/subscription_manager/cache.py", line 576, in _query_for_update
    response = uep.getAccessibleContent(self.identity.uuid, if_modified_since=if_modified_since)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 1125, in getAccessibleContent
    return self.conn.request_get(method, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 614, in request_get
    return self._request("GET", method, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 640, in _request
    info=info, headers=headers)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 529, in _request
    self.validateResponse(result, request_type, handler)
  File "/usr/lib64/python2.7/site-packages/rhsm/connection.py", line 578, in validateResponse
    raise RestlibException(response['status'], error_msg, response.get('headers'))
RestlibException: No content access mode assigned
Comment 2 Kevin Howell 2017-05-08 14:38:02 UTC 
First question is why isn't the content access cert removed on refresh. I suspect this is the root cause of the issue in subscription-manager.
Comment 4 Shwetha Kallesh 2017-05-18 10:00:54 UTC 
Marking verified!!


[root@dhcp71-112 ~]# subscription-manager version
server type: Red Hat Subscription Management
subscription management server: 0.9.51.23-1
subscription management rules: 5.15.1
subscription-manager: 1.19.14-1.el7
python-rhsm: 1.19.6-1.el7


[root@dhcp71-112 ~]# subscription-manager register --force --serverurl Shwetha-candlepin.usersys.redhat.com:8443/candlepin
Registering to: Shwetha-candlepin.usersys.redhat.com:8443/candlepin
Username: admin
Password: 
Organization: snowwhite
The system has been registered with ID: 19b9dfac-00c6-4ba8-8cc7-0a831fa41b6e 

[root@dhcp71-112 ~]# rct cat-cert /etc/pki/entitlement/8149841718942640303.pem --no-products --no-content 

+-------------------------------------------+
	Entitlement Certificate
+-------------------------------------------+

Certificate:
	Path: /etc/pki/entitlement/8149841718942640303.pem
	Version: 3.3
	Serial: 8149841718942640303
	Start Date: 2017-05-18 08:55:29+00:00
	End Date: 2018-05-18 08:55:29+00:00
	Pool ID: Not Available

Subject:
	CN: 19b9dfac-00c6-4ba8-8cc7-0a831fa41b6e
	O: snowwhite

Issuer:
	C: US
	CN: Shwetha-candlepin.usersys.redhat.com
	L: Raleigh


Order:
	Name: Content Access
	Number: 
	SKU: content_access
	Contract: 
	Account: 
	Service Level: 
	Service Type: 
	Quantity: 
	Quantity Used: 1
	Socket Limit: 
	RAM Limit: 
	Core Limit: 
	Virt Only: False
	Stacking ID: 
	Warning Period: 0
	Provides Management: False

[root@dhcp71-112 ~]# curl --stderr /dev/null --insecure --user admin:admin --request PUT --data '{"contentAccessMode":""}' --header 'accept: application/json' --header 'content-type: application/json' https://Shwetha-candlepin.usersys.redhat.com:8443/candlepin/owners/snowwhite
{"parentOwner":null,"id":"8ac6a3185c0c3e24015c0c41c4520002","key":"snowwhite","displayName":"Snow White","contentPrefix":null,"defaultServiceLevel":null,"upstreamConsumer":null,"logLevel":null,"autobindDisabled":null,"contentAccessMode":null,"contentAccessModeList":"org_environment","href":"/owners/snowwhite","created":"2017-05-15T13:17:35+0000","updated":"2017-05-18T09:57:05+0000"}


[root@dhcp71-112 ~]#  subscription-manager refresh
1 local certificate has been deleted.
All local data refreshed


[root@dhcp71-112 ~]# ls /etc/pki/entitlement/
[root@dhcp71-112 ~]# subscription-manager repos --list
This system has no repositories available through subscriptions.

[root@dhcp71-112 ~]# rct cat-cert /etc/pki/entitlement/8149841718942640303.pem --no-products --no-content The specified certificate file does not exist.
Comment 5 errata-xmlrpc 2017-08-01 19:23:41 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:2083
Note You need to log in before you can comment on or make changes to this bug.