Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 738762 - API is not supporting identity certificates
Summary: API is not supporting identity certificates
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: API
Version: 6.0.1
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: Unspecified
Assignee: Ivan Necas
QA Contact: Jitendra Yejare
URL:
Whiteboard:
Depends On:
Blocks: katello-blockers
TreeView+ depends on / blocked
 
Reported: 2011-09-15 18:15 UTC by Bryan Kearney
Modified: 2019-09-25 21:27 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-08-22 17:57:03 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)

Description Bryan Kearney 2011-09-15 18:15:27 UTC 
Got alot further this time on the basic patch management stories. Latets issue is because of certifiates. 

If i register a consumer, it uses basic auth. Future calls use an identity certificate. Here is an example.

Register a machine using subscription manager. Assume the machines UUID is now:

a7a248fd-9c53-4b01-b4ee-cb83f5469bb0


the following command will work:

sudo curl -k --user "admin:admin"  https://10.11.230.185/katello/api/consumers/a7a248fd-9c53-4b01-b4ee-cb83f5469bb0


the following will not

sudo curl -k --cert /etc/pki/consumer/cert.pem --key /etc/pki/consumer/key.pem  https://10.11.230.185/katello/api/consumers/a7a248fd-9c53-4b01-b4ee-cb83f5469bb0


The identity ceritifcate carries the ID of the consumer and needs to be extracted. Both calls should have worked.

-- bk
Comment 1 Ivan Necas 2011-09-16 15:40:33 UTC 
The problem was that apache,that provides ssl layer for katello now, wasn't configured to perform SSL client verification. I've set it up in commit 4c1e2ac05156174f51d479d2f26845a84f9d3905 .

It's configured in a way, that apache performs the certificate verification and then sends the SSL_CLIENT_CERT to the thin for katello to be able to do authorization.t

The registrations works fine (the system is created together with creating consumers in cp and pulp). 

Another problem occured when subscription-manager tried to send package profile. We were getting the following message from apache:

413 Request        Entity Too Large
The requested resource /katello/api/consumers/bb9493e3-43f8-8a35-66cd2154aeb     d/packages does not allow request data with PUT requests, or the amount of        data provided in\nthe request exceeds the capacity limit.

For default, there is limitation for the SSL verified requests to 128KB see [1]. After changing SSLRenegBufferSize to 262144 (coommit 1a00e4cb9f08cf2abea36bfb23a6a24d59ff0ca6) the registration works together with sending the package profile.

However this limitation might be a problem in future, and we should be aware of it.

As part of debugging, I've also fixed a problems with proxy requests related to changes of our API path to /katello/api. (commit f66825ede9c9503cd9bd2784c94f8e16d65ff7be)

[1] - https://issues.apache.org/bugzilla/show_bug.cgi?id=39243
Comment 2 Jeff Weiss 2011-09-28 15:17:27 UTC 
Verified, katello-0.1.85-1.git.45.c6e1331.fc14.noarch
Comment 5 Mike McCune 2013-08-16 18:07:04 UTC 
getting rid of 6.0.0 version since that doesn't exist
Note You need to log in before you can comment on or make changes to this bug.