Bug 1618392
| Summary: | org_environment content access mode - authentication error while an environment is updated on the client | |||
|---|---|---|---|---|
| Product: | Red Hat Satellite | Reporter: | sthirugn <sthirugn> | |
| Component: | Candlepin | Assignee: | satellite6-bugs <satellite6-bugs> | |
| Status: | CLOSED ERRATA | QA Contact: | sthirugn <sthirugn> | |
| Severity: | high | Docs Contact: | ||
| Priority: | high | |||
| Version: | 6.3.2 | CC: | khowell, nsamant, pgervase, rjerrido, zhunting | |
| Target Milestone: | 6.4.0 | Keywords: | Triaged | |
| Target Release: | Unused | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | candlepin-2.1.22-1, candlepin-2.4.6-1 | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1618491 1618492 1618493 1624036 (view as bug list) | Environment: | ||
| Last Closed: | 2018-10-16 19:01:46 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 1618492, 1618493 | |||
| Bug Blocks: | ||||
Now I can consistently reproduce and found two candlepin issues: Note: make sure that the test client does not get any guest subscriptions or any subscriptions from auto attach. It should be all org_environment content access only to properly reproduce this error: 1. I always tested with Library/Default_Organization_View and this created the candlepin cert with OU: Library - Perhaps Default_Organization_View is not really a lifecycle environment but it is more like all content. So for this reason, when I tested changing to a different environment say Library/rhel7cv or Library/new_rhel7cv, they all worked just fine. I believe this will get addressed when the below issue is fixed. 2. I changed the activation key to Library/rhel7cv. Registered the client. Turned off autoattach again. Changed the environment to Library/new_rhel7cv. Error is reproduced!!!! - https://bugzilla.redhat.com/show_bug.cgi?id=1618392 Verified on satellite-6.4.0-14.el7sat.noarch
- Registered a client to a Satellite organization with org_environment content access mode.
On the client:
# subscription-manager register --org="Default_Organization" --activationkey="rhel7ak"
The system has been registered with ID: 831de208-e4e0-4fa8-af54-5f1670caedde
The registered system name is: client.rhsm-qe-3.example.com
Installed Product Current Status:
Product Name: Red Hat Enterprise Linux Server
Status: Not Subscribed
Unable to find available subscriptions for all your installed products.
# rct cat-cert /etc/pki/entitlement/5243112181457813382.pem | grep OU
OU: Library/rhel7cv
OU: SomeOrgUnit
- At this point, I updated the content view of the content host to new_rhel7cv in Satellite UI
# subscription-manager refresh
1 local certificate has been deleted.
All local data refreshed
# yum clean all
Loaded plugins: enabled_repos_upload, package_upload, product-id, search-disabled-repos,
: subscription-manager
This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions.
There are no enabled repos.
Run "yum repolist all" to see the repos you have.
To enable Red Hat Subscription Management repositories:
subscription-manager repos --enable <repo>
To enable custom repositories:
yum-config-manager --enable <repo>
Uploading Enabled Repositories Report
Loaded plugins: product-id, subscription-manager
This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions.
# yum repolist
Loaded plugins: enabled_repos_upload, package_upload, product-id, search-disabled-repos,
: subscription-manager
This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions.
repolist: 0
Uploading Enabled Repositories Report
Loaded plugins: product-id, subscription-manager
This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions.
# rct cat-cert /etc/pki/entitlement/4500987876898396127.pem | grep OU
OU: Library/new_rhel7cv
OU: SomeOrgUnit
# subscription-manager repos --enable rhel-7-server-rpms
# yum install vim
Loaded plugins: enabled_repos_upload, package_upload, product-id, search-disabled-repos,
: subscription-manager
This system is registered with an entitlement server, but is not receiving updates. You can use subscription-manager to assign subscriptions.
rhel-7-server-rpms | 2.0 kB 00:00:00
...
...
<succeeded>
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2018:2927 |
Description of problem: org_environment content access mode - authentication error while an environment is updated on the client Version-Release number of selected component (if applicable): satellite-6.3.2-1.el7sat.noarch candlepin-selinux-2.1.15-1.el7.noarch candlepin-2.1.15-1.el7.noarch How reproducible: Not yet reproducible in-house, but reproducible in customer environment Steps to Reproduce: In org_environemnt content access mode, - Use bootstrap.py to register a client to Satellite - Immediately after the registration, the client's content view is updated directly using Satellite api. - `Subscription-manager refresh` on the client - `yum clean all` on the client - `yum repolist` on the client -> results in 403 forbidden errors on the client. Request denied to destination [/pulp/repos/ACME/Library/TEST-RHEL-7-C V-2018_32-OS/content/dist/rhel/server/7/7Server/x86_64/oracle-java-rm/os/repodat a/repomd.xml]Client certificate failed extension check for destination: /pulp/repos/ACME/Library/TEST-RHEL-7-CV-2018_32-OS/content/dist/rhel/server/7/7Se rver/x86_64/oracle-java-rm/os/repodata/repomd.xml - /etc/pki/entitlement contents are in the attachment of this invite. It was found that the cert had the mismatch in the OU entry and URL as shown below. TEST-RHEL-7-CV-2018_30-OS is coming from the old content view, TEST-RHEL-7-CV-2018_33-OS is coming from the new content view: OU: Library/TEST-RHEL-7-CV-2018_30-OS URL: /DPS_Satellite/Library/TEST-RHEL-7-CV-2018_33-OS/content/dist/rhel/server/7/$releasever/$basearch/oracle-java-rm/os - This scenario works fine on non org_environment content access mode. Actual results: Content view update on the client makes the client unable to access content. Expected results: content view update should work fine on the client, should able to access content. Additional info: