Bug 738762 - API is not supporting identity certificates
Summary: API is not supporting identity certificates
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Satellite 6
Classification: Red Hat
Component: API
Version: 6.0.1
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified vote
Target Milestone: Unspecified
Assignee: Ivan Necas
QA Contact: Jitendra Yejare
URL:
Whiteboard:
Depends On:
Blocks: katello-blockers
TreeView+ depends on / blocked
 
Reported: 2011-09-15 18:15 UTC by Bryan Kearney
Modified: 2019-02-25 21:56 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-08-22 17:57:03 UTC


Attachments (Terms of Use)

Description Bryan Kearney 2011-09-15 18:15:27 UTC
Got alot further this time on the basic patch management stories. Latets issue is because of certifiates. 

If i register a consumer, it uses basic auth. Future calls use an identity certificate. Here is an example.

Register a machine using subscription manager. Assume the machines UUID is now:

a7a248fd-9c53-4b01-b4ee-cb83f5469bb0


the following command will work:

sudo curl -k --user "admin:admin"  https://10.11.230.185/katello/api/consumers/a7a248fd-9c53-4b01-b4ee-cb83f5469bb0


the following will not

sudo curl -k --cert /etc/pki/consumer/cert.pem --key /etc/pki/consumer/key.pem  https://10.11.230.185/katello/api/consumers/a7a248fd-9c53-4b01-b4ee-cb83f5469bb0


The identity ceritifcate carries the ID of the consumer and needs to be extracted. Both calls should have worked.

-- bk

Comment 1 Ivan Necas 2011-09-16 15:40:33 UTC
The problem was that apache,that provides ssl layer for katello now, wasn't configured to perform SSL client verification. I've set it up in commit 4c1e2ac05156174f51d479d2f26845a84f9d3905 .

It's configured in a way, that apache performs the certificate verification and then sends the SSL_CLIENT_CERT to the thin for katello to be able to do authorization.t

The registrations works fine (the system is created together with creating consumers in cp and pulp). 

Another problem occured when subscription-manager tried to send package profile. We were getting the following message from apache:

413 Request        Entity Too Large
The requested resource /katello/api/consumers/bb9493e3-43f8-8a35-66cd2154aeb     d/packages does not allow request data with PUT requests, or the amount of        data provided in\nthe request exceeds the capacity limit.

For default, there is limitation for the SSL verified requests to 128KB see [1]. After changing SSLRenegBufferSize to 262144 (coommit 1a00e4cb9f08cf2abea36bfb23a6a24d59ff0ca6) the registration works together with sending the package profile.

However this limitation might be a problem in future, and we should be aware of it.

As part of debugging, I've also fixed a problems with proxy requests related to changes of our API path to /katello/api. (commit f66825ede9c9503cd9bd2784c94f8e16d65ff7be)

[1] - https://issues.apache.org/bugzilla/show_bug.cgi?id=39243

Comment 2 Jeff Weiss 2011-09-28 15:17:27 UTC
Verified, katello-0.1.85-1.git.45.c6e1331.fc14.noarch

Comment 5 Mike McCune 2013-08-16 18:07:04 UTC
getting rid of 6.0.0 version since that doesn't exist


Note You need to log in before you can comment on or make changes to this bug.