Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1618392

Summary: org_environment content access mode - authentication error while an environment is updated on the client
Product: Red Hat Satellite Reporter: sthirugn <sthirugn>
Component: CandlepinAssignee: satellite6-bugs <satellite6-bugs>
Status: CLOSED ERRATA QA Contact: sthirugn <sthirugn>
Severity: high Docs Contact:
Priority: high    
Version: 6.3.2CC: khowell, nsamant, pgervase, rjerrido, zhunting
Target Milestone: 6.4.0Keywords: Triaged
Target Release: Unused   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: candlepin-2.1.22-1, candlepin-2.4.6-1 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1618491 1618492 1618493 1624036 (view as bug list) Environment:
Last Closed: 2018-10-16 19:01:46 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1618492, 1618493    
Bug Blocks:    

Description sthirugn@redhat.com 2018-08-16 14:15:41 UTC
Description of problem:
org_environment content access mode - authentication error while an environment is updated on the client

Version-Release number of selected component (if applicable):
satellite-6.3.2-1.el7sat.noarch
candlepin-selinux-2.1.15-1.el7.noarch
candlepin-2.1.15-1.el7.noarch

How reproducible:
Not yet reproducible in-house, but reproducible in customer environment

Steps to Reproduce:
In org_environemnt content access mode,
- Use bootstrap.py to register a client to Satellite
- Immediately after the registration, the client's content view is updated directly using Satellite api.
     - `Subscription-manager refresh` on the client
     - `yum clean all` on the client
     - `yum repolist` on the client -> results in 403 forbidden errors on the client.
            Request denied to destination [/pulp/repos/ACME/Library/TEST-RHEL-7-C V-2018_32-OS/content/dist/rhel/server/7/7Server/x86_64/oracle-java-rm/os/repodat a/repomd.xml]Client certificate failed extension check for destination: /pulp/repos/ACME/Library/TEST-RHEL-7-CV-2018_32-OS/content/dist/rhel/server/7/7Se rver/x86_64/oracle-java-rm/os/repodata/repomd.xml

- /etc/pki/entitlement contents are in the attachment of this invite. It was found that the cert had the mismatch in the OU entry and URL as shown below. TEST-RHEL-7-CV-2018_30-OS is coming from the old content view, TEST-RHEL-7-CV-2018_33-OS is coming from the new content view:

   OU: Library/TEST-RHEL-7-CV-2018_30-OS
   URL: /DPS_Satellite/Library/TEST-RHEL-7-CV-2018_33-OS/content/dist/rhel/server/7/$releasever/$basearch/oracle-java-rm/os
- This scenario works fine on non org_environment content access mode.

Actual results:
Content view update on the client makes the client unable to access content.

Expected results:
content view update should work fine on the client, should able to access content.

Additional info:

Comment 2 sthirugn@redhat.com 2018-08-16 16:59:55 UTC
Now I can consistently reproduce and found two candlepin issues:

Note: make sure that the test client does not get any guest subscriptions or any subscriptions from auto attach.  It should be all org_environment content access only to properly reproduce this error:

1. I always tested with Library/Default_Organization_View and this created the candlepin cert with OU: Library - Perhaps Default_Organization_View is not really a lifecycle environment but it is more like all content. So for this reason, when I tested changing to a different environment say Library/rhel7cv or Library/new_rhel7cv, they all worked just fine. I believe this will get addressed when the below issue is fixed.

2. I changed the activation key to Library/rhel7cv. Registered the client. Turned off autoattach again. Changed the environment to Library/new_rhel7cv. Error is reproduced!!!! - https://bugzilla.redhat.com/show_bug.cgi?id=1618392

Comment 13 sthirugn@redhat.com 2018-09-13 21:50:45 UTC
Verified on satellite-6.4.0-14.el7sat.noarch

- Registered a client to a Satellite organization with org_environment content access mode.

On the client:

# subscription-manager register --org="Default_Organization" --activationkey="rhel7ak"
The system has been registered with ID: 831de208-e4e0-4fa8-af54-5f1670caedde
The registered system name is: client.rhsm-qe-3.example.com
Installed Product Current Status:
Product Name: Red Hat Enterprise Linux Server
Status:       Not Subscribed

Unable to find available subscriptions for all your installed products.

# rct cat-cert /etc/pki/entitlement/5243112181457813382.pem | grep OU
	OU: Library/rhel7cv
	OU: SomeOrgUnit

- At this point, I updated the content view of the content host to new_rhel7cv in Satellite UI

# subscription-manager refresh
1 local certificate has been deleted.
All local data refreshed

# yum clean all
Loaded plugins: enabled_repos_upload, package_upload, product-id, search-disabled-repos,
              : subscription-manager
This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions.
There are no enabled repos.
 Run "yum repolist all" to see the repos you have.
 To enable Red Hat Subscription Management repositories:
     subscription-manager repos --enable <repo>
 To enable custom repositories:
     yum-config-manager --enable <repo>
Uploading Enabled Repositories Report
Loaded plugins: product-id, subscription-manager
This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions.

# yum repolist
Loaded plugins: enabled_repos_upload, package_upload, product-id, search-disabled-repos,
              : subscription-manager
This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions.
repolist: 0
Uploading Enabled Repositories Report
Loaded plugins: product-id, subscription-manager
This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions.

# rct cat-cert /etc/pki/entitlement/4500987876898396127.pem | grep OU
	OU: Library/new_rhel7cv
	OU: SomeOrgUnit

# subscription-manager repos --enable rhel-7-server-rpms

# yum install vim
Loaded plugins: enabled_repos_upload, package_upload, product-id, search-disabled-repos,
              : subscription-manager
This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions.
rhel-7-server-rpms                                                  | 2.0 kB  00:00:00     
...
...
<succeeded>

Comment 14 Bryan Kearney 2018-10-16 19:01:46 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2018:2927