Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1961390

Summary:	Encountering an unexpected "HTTP error (403 - Forbidden)" when attempting to attach non-multi-entitlement pools with a quantity
Product:	Red Hat Enterprise Linux 9	Reporter:	John Sefler <jsefler>
Component:	subscription-manager	Assignee:	candlepin-bugs
Status:	CLOSED NOTABUG	QA Contact:	Red Hat subscription-manager QE Team <rhsm-qe>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	9.0	CC:	redakkan
Target Milestone:	beta	Keywords:	Regression, Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-06-25 15:29:38 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description John Sefler 2021-05-17 19:33:06 UTC

Description of problem:

I suspect the following commit during the development of the main branch of subscription-manager for RHEL9 introduced a regression (from RHEL8) for exception handling...
https://github.com/candlepin/subscription-manager/commit/9a9b37c Refactor managercli (#2453)

Version-Release number of selected component (if applicable):
[root@kvm-05-guest14 ~]# rpm -q subscription-manager
subscription-manager-1.29.9-1.el9.x86_64
[root@kvm-05-guest14 ~]# rpm -q subscription-manager --changelog | grep "Refactor managercli"
- Refactor managercli (#2453) (wpoteat)


How reproducible:
occurs when attempting to attach a non-multi-entitlement pool with a --quantity greater than 1

Steps to Reproduce:
ON A RHEL9 SYSTEM....
[root@kvm-05-guest14 ~]# subscription-manager register --serverurl=subscription.rhsm.stage.redhat.com --username=stage_auto_testuser
Registering to: subscription.rhsm.stage.redhat.com:443/subscription
Password: 
The system has been registered with ID: cb5789d9-afba-4969-ad1f-6794c42b806f
The registered system name is: kvm-05-guest14.hv2.lab.eng.bos.redhat.com
[root@kvm-05-guest14 ~]# 
[root@kvm-05-guest14 ~]# subscription-manager list --avail --matches=RH0103708 --pool-only
8a99f9ac75743133017575f553fc0093
8a99f9ac75743133017575f5541c0095
[root@kvm-05-guest14 ~]# subscription-manager attach --quantity=2 --pool=8a99f9ac75743133017575f553fc0093 --pool=8a99f9ac75743133017575f5541c0095
HTTP error (403 - Forbidden): Multi-entitlement not supported for pool with ID "8a99f9ac75743133017575f553fc0093".
HTTP error (403 - Forbidden): Multi-entitlement not supported for pool with ID "8a99f9ac75743133017575f5541c0095".
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Actual results:
 Prefix "HTTP error (403 - Forbidden): " is now included in the stdout, but is not a true error logged to rhsm.log

Expected results:
  Expected the same long-time RHEL8|RHEL7|RHEL6 behavior as shown below on a RHEL8.5 system against the exact same entitlement server with the exact same account...



Additional info:
ON A RHEL8 SYSTEM....
[root@kvm-05-guest13 ~]# rpm -q subscription-manager
subscription-manager-1.28.16-1.el8.x86_64
[root@kvm-05-guest13 ~]# rpm -q subscription-manager --changelog | grep "Refactor managercli"
[root@kvm-05-guest13 ~]# 
[root@kvm-05-guest13 ~]# rpm -q subscription-manager
subscription-manager-1.28.16-1.el8.x86_64
[root@kvm-05-guest13 ~]# rpm -q subscription-manager --changelog | grep "Refactor managercli"
[root@kvm-05-guest13 ~]# 
[root@kvm-05-guest13 ~]# subscription-manager register --serverurl=subscription.rhsm.stage.redhat.com --username=stage_auto_testuser
Registering to: subscription.rhsm.stage.redhat.com:443/subscription
Password: 
The system has been registered with ID: 71a71995-5a1e-4a53-a255-13b2fb9b2063
The registered system name is: kvm-05-guest13.hv2.lab.eng.bos.redhat.com
[root@kvm-05-guest13 ~]# 
[root@kvm-05-guest13 ~]# subscription-manager list --avail --matches=RH0103708 --pool-only
8a99f9ac75743133017575f553fc0093
8a99f9ac75743133017575f5541c0095
[root@kvm-05-guest13 ~]# subscription-manager attach --quantity=2 --pool=8a99f9ac75743133017575f553fc0093 --pool=8a99f9ac75743133017575f5541c0095
Multi-entitlement not supported for pool with ID "8a99f9ac75743133017575f553fc0093".
Multi-entitlement not supported for pool with ID "8a99f9ac75743133017575f5541c0095".

^^^^ Notice there is no unexpected prefix of "HTTP error (403 - Forbidden): " exception handling on subscription-manager-1.28

Comment 3 John Sefler 2021-05-18 15:10:42 UTC

Here is another repeatable case showing an error handling difference between subscription-manager-1.29.9-1.el9 and subscription-manager-1.28.16-1.el8

ON RHEL9...
[root@kvm-05-guest14 ~]# echo '{"system.certificate_version":"1.0"}' > /etc/rhsm/facts/override.facts
[root@kvm-05-guest14 ~]# subscription-manager facts --update
[root@kvm-05-guest14 ~]# subscription-manager list --available --matches=RH00003 --pool-only
8a99f9af75743153017575f6af7f00cf
[root@kvm-05-guest14 ~]# subscription-manager attach --pool=8a99f9af75743153017575f6af7f00cf
HTTP error (500 - Internal Server Error): Too many content sets for certificate Red Hat Enterprise Linux Server, Premium (Physical or Virtual Nodes). A newer client may be available to address this problem. See knowledge database https://access.redhat.com/knowledge/node/129003 for more information.


ON RHEL8...
[root@kvm-05-guest13 ~]# echo '{"system.certificate_version":"1.0"}' > /etc/rhsm/facts/override.facts
[root@kvm-05-guest13 ~]# subscription-manager facts --update
Successfully updated the system facts.
[root@kvm-05-guest13 ~]# subscription-manager list --available --matches=RH00003 --pool-only
8a99f9af75743153017575f6af7f00cf
[root@kvm-05-guest13 ~]# subscription-manager attach --pool=8a99f9af75743153017575f6af7f00cf
Too many content sets for certificate Red Hat Enterprise Linux Server, Premium (Physical or Virtual Nodes). A newer client may be available to address this problem. See knowledge database https://access.redhat.com/knowledge/node/129003 for more information.


Again, notice the error handling difference "HTTP error (500 - Internal Server Error): "

Comment 5 John Sefler 2021-06-08 18:04:59 UTC

Here is another repeatable case showing an error handling difference between subscription-manager-1.29.9-1.el9 and subscription-manager-1.28.16-1.el8
This is after a negative attempt to attach this pool a second time...

ON RHEL9...
[root@kvm-02-guest16 ~]# subscription-manager attach --pool=8a99f9ae75743158017575f844e800a0
HTTP error (403 - Forbidden): This unit has already had the subscription matching pool ID "8a99f9ae75743158017575f844e800a0" attached.


ON RHEL8...
[root@kvm-03-guest17 ~]# subscription-manager attach --pool=8a99f9ae75743158017575f844e800a0
This unit has already had the subscription matching pool ID "8a99f9ae75743158017575f844e800a0" attached.


Again, notice the error handling difference "HTTP error (403 - Forbidden): "

Comment 6 John Sefler 2021-06-24 14:54:32 UTC

This issue might be closed as notabug since one could argue that the former error handling on RHEL8 was actually flawed and masked the developer's original intention to report server-side error codes (as introduced by the solution for bug 1507030) which is now more obvious after the "Refactor managercli (#2453)" commit for RHEL9.

Comment 7 Pino Toscano 2021-06-25 15:29:38 UTC

(In reply to John Sefler from comment #6)
> This issue might be closed as notabug since one could argue that the former
> error handling on RHEL8 was actually flawed and masked the developer's
> original intention to report server-side error codes (as introduced by the
> solution for bug 1507030) which is now more obvious after the "Refactor
> managercli (#2453)" commit for RHEL9.

This is what we agreed on; I filed bug 1976240 as RFE for improving the error string.

Hence, closing this as NOTABUG, since the current behaviour is what was expected.