Red Hat Bugzilla – Bug 892990
The server address should not be "localhost" on user account info page
Last modified: 2017-03-08 12:34 EST
Description of problem: When I access thhe account info page "https://broker.example.com/console/account", it shows that: Personal Information: You are authenticated to the server localhost with the login jia. The server name should not be "localhost". Walk around: Firstly: Modify "BROKER_URL=http://broker.example.com:8080/broker/rest" in /etc/openshift/console.conf Second: Modify "Listen 0.0.0.0:8080" in /var/www/openshift/broker/httpd/broker.conf Thirdly: lokkit --port=8080:tcp Finally: restart openshift-broker and openshift-console service. Version-Release number of selected component (if applicable): http://buildvm-devops.usersys.redhat.com/puddle/build/OpenShiftEnterprise/1.1.x/2013-01-07.2/ How reproducible: always Steps to Reproduce: 1.Visit user's account info page Actual results: You are authenticated to the server localhost with the login jia. Expected results: You are authenticated to the server broker.example.com with the login jia. Should not "localhost"
Here's another way to workaround the problem. In /etc/openshift/console.conf: BROKER_URL=http://broker.example.com:8080/broker/rest BROKER_PROXY_URL=http://localhost:8080/broker/rest That appeared to work on my install. We should probably consider updating our documentation if this is sufficient.
We talked a little bit about this offline. We'd prefer _not_ to do any sort of configuration hacks because the configuration is already complicated enough as it is. In Enterprise the connection between the console and the broker must happen via directly to 127.0.0.1:8080 we are trusting the connection and passing the authentication straight through. We're considering removing the text 'to the server <strong>#{RestApi.site.host}</strong>' from app/views/account/_user.html.haml.
I'm ambivalent - this is fine for enterprise in a specific config. It might make sense to instead change the code to ['127.0.0.1', 'localhost'].include?(RestApi.site.host) ? request.host : RestApi.site.host You'll have to check request.host, this may not work from a view. The idea is to use the current web host if the broker is set to loopback.
I've created Bug #893172 for us to allow console and broker to securely live on separate hosts. At that time we'll readdress this issue. For now we're going to solve this in Enterprise as Clayton suggests.
This will ship with the next 1.1 puddle.
Verify: You are authenticated to the server broker.example.com with the login jia. Version: http://buildvm-devops.usersys.redhat.com/puddle/build/OpenShiftEnterprise/1.1.x/2013-01-08.1/
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0220.html