Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1459619

Summary: Subscription manager should not allow registration by email address
Product: [Community] Candlepin (Migrated to Jira) Reporter: Richard Bernleithner <rbernlei>
Component: candlepinAssignee: candlepin-bugs
Status: CLOSED NOTABUG QA Contact: Katello QA List <katello-qa-list>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 2.0CC: bcourt, khowell, rbernlei, redakkan, skallesh
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-06-12 20:20:36 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1431334    

Description Richard Bernleithner 2017-06-07 15:22:00 UTC
Description of problem:

subscription manager allows users to register consumer using associated email address. It passes email address as username in Candlepin, which is incorrect.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.register consumer using email address instead of username

ex: subscription-manager register --username 'pdr-it' --password '[REDACTED]'
The system has been registered with ID: 224c8efc-af63-4bef-9606-dfe54e09bf04

2. Look up username for consumer in Candlepin
3.

Actual results:

username in Candlepin is email address pdr-it

Expected results:

username in Candlepin should be pdrit

or

subscription manager should not allow registration via email address in the first place.


Additional info:

Comment 1 Kevin Howell 2017-06-08 14:19:48 UTC
From our perspective, subscription-manager is simply passing the credentials along, and candlepin simply passes the credentials down to the services (in the case of IT-hosted candlepin, down to those services).

If you are talking about the *consumer name* rather than the *username*, then this can be set explicitly with subscription-manager register with --name=$desiredname. (The default consumer name is the hostname).

Please clarify:
 - Are you talking about username or consumer name?
 - What purpose does removing the '-' from the username serve?

Comment 2 Richard Bernleithner 2017-06-08 16:42:15 UTC
(In reply to Kevin Howell from comment #1)
> From our perspective, subscription-manager is simply passing the credentials
> along, and candlepin simply passes the credentials down to the services (in
> the case of IT-hosted candlepin, down to those services).
> 
> If you are talking about the *consumer name* rather than the *username*,
> then this can be set explicitly with subscription-manager register with
> --name=$desiredname. (The default consumer name is the hostname).
> 
> Please clarify:
>  - Are you talking about username or consumer name?
>  - What purpose does removing the '-' from the username serve?

I'm referring to username. Complete details are in associated bug https://bugzilla.redhat.com/show_bug.cgi?id=1431334#c10

The user's email address is pdr-it and their username is pdrit
They were able to register consumer using their email address. This email address was passed onto Candlepin as username, which is incorrect. subscription-manager should either  pass the associated username to username field in Candlepin, or not allow registration via email address.

Comment 3 Barnaby Court 2017-06-12 20:20:36 UTC
Candlepin is a passthrough to the SSO in this case. There is no validation or normalization that can be done in candlepin or subscription-manager that would be useful. The only change I could think of would be an RFE to replace the username specified with the user with the username from the Principal that is returned from the UserServiceAdapter if they are different.

Comment 4 Richard Bernleithner 2017-08-08 15:53:35 UTC
(In reply to Barnaby Court from comment #3)
> Candlepin is a passthrough to the SSO in this case. There is no validation
> or normalization that can be done in candlepin or subscription-manager that
> would be useful. The only change I could think of would be an RFE to replace
> the username specified with the user with the username from the Principal
> that is returned from the UserServiceAdapter if they are different.

What team would this RFE be filed under?