Got alot further this time on the basic patch management stories. Latets issue is because of certifiates.
If i register a consumer, it uses basic auth. Future calls use an identity certificate. Here is an example.
Register a machine using subscription manager. Assume the machines UUID is now:
the following command will work:
sudo curl -k --user "admin:admin" https://10.11.230.185/katello/api/consumers/a7a248fd-9c53-4b01-b4ee-cb83f5469bb0
the following will not
sudo curl -k --cert /etc/pki/consumer/cert.pem --key /etc/pki/consumer/key.pem https://10.11.230.185/katello/api/consumers/a7a248fd-9c53-4b01-b4ee-cb83f5469bb0
The identity ceritifcate carries the ID of the consumer and needs to be extracted. Both calls should have worked.
The problem was that apache,that provides ssl layer for katello now, wasn't configured to perform SSL client verification. I've set it up in commit 4c1e2ac05156174f51d479d2f26845a84f9d3905 .
It's configured in a way, that apache performs the certificate verification and then sends the SSL_CLIENT_CERT to the thin for katello to be able to do authorization.t
The registrations works fine (the system is created together with creating consumers in cp and pulp).
Another problem occured when subscription-manager tried to send package profile. We were getting the following message from apache:
413 Request Entity Too Large
The requested resource /katello/api/consumers/bb9493e3-43f8-8a35-66cd2154aeb d/packages does not allow request data with PUT requests, or the amount of data provided in\nthe request exceeds the capacity limit.
For default, there is limitation for the SSL verified requests to 128KB see . After changing SSLRenegBufferSize to 262144 (coommit 1a00e4cb9f08cf2abea36bfb23a6a24d59ff0ca6) the registration works together with sending the package profile.
However this limitation might be a problem in future, and we should be aware of it.
As part of debugging, I've also fixed a problems with proxy requests related to changes of our API path to /katello/api. (commit f66825ede9c9503cd9bd2784c94f8e16d65ff7be)
 - https://issues.apache.org/bugzilla/show_bug.cgi?id=39243
getting rid of 6.0.0 version since that doesn't exist