Description of problem:

With the new build of Candlepin 4.1.10 they have changed the way entitlement certificates are generated. Before they would look like:

Subject: CN=eb48d5a8-b759-417c-97f7-93dc2369de29

Now the new cert looks like:

Subject: O=Default_Organization, CN=eb48d5a8-b759-417c-97f7-93dc2369de29

So we get an unauthorized because of the way we parse the ID which now comes back looking like:

"/O=Default_Organizationeb48d5a8-b759-417c-97f7-93dc2369de29"

This issue is to address the way we grab the CN from the cert so it works for the new version of Candlepin and the older versions.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. Install nightly devel box or 7.0
2. Upgrade candlepin to 4.1.10 from here https://brewweb.engineering.redhat.com/brew/packageinfo?packageID=30479
3.Follow the steps here to update it: https://theforeman.org/plugins/katello/developers.html#upgrading-candlepin

Actual results:
trying to either register a client or talk to the /rhsm endpoint on Katello returns a 401 unauthorized error. We see the register work the first time since that is user/pass but the 2nd call to the /rshm endpoint fails since we use the identity cert.

Expected results:
Client registrations able to work correctly and not get a 401 unauthorized error

Additional info:

Candlepin team confirmed this change was intentional:

<bcourt> Toledo, yes, adding the org-id to the identity cert was intentional
<bcourt> basically, consistency with the entitlement certs