[PATCH Audrey 1/2] Fix for 401 on HTTP PUT

gblomqui at redhat.com gblomqui at redhat.com
Fri Dec 16 16:50:01 UTC 2011


From: Greg Blomquist <gblomqui at redhat.com>

https://bugzilla.redhat.com/show_bug.cgi?id=760377

The fix for this involves including a bit of a hack in the authentication
process.  The underlying problem appears to be that certain older OAuth libraries
(python-oauth2-1.2.1-3.fc15.noarch) do not include the request body in the part
of the request that's signed with HTTP PUTs.  However, newer OAuth libraries
(python-oauth2-1.5.170-2.fc16.noarch) do include the entire request body in the
signature for HTTP PUTs.

The fix introduced in this patch attempts to authenticate the request first by
including the entire request body in the signature validation.  If that fails,
it attempts to authenticate the request by removing the request body (i.e., only
uses headers) in the signature validation.  If that fails, then the request
cannot be authenticated and a 401 is returned.
---
 configserver/Rakefile                      |    2 +-
 configserver/aeolus-configserver.spec.in   |    4 +++-
 configserver/src/config.in.ru              |   12 ------------
 configserver/src/lib/application_helper.rb |   16 ++++++++++++++--
 configserver/src/spec/spec_helper.rb       |    1 -
 5 files changed, 18 insertions(+), 17 deletions(-)

diff --git a/configserver/Rakefile b/configserver/Rakefile
index 4d89ba8..fd71979 100644
--- a/configserver/Rakefile
+++ b/configserver/Rakefile
@@ -24,7 +24,7 @@ require 'rake/clean'
 require 'rubygems'
 require 'rubygems/package_task'
 
-version = '0.4.3'
+version = '0.4.4'
 man_section = '8'
 pkg_name = 'aeolus-configserver'
 
diff --git a/configserver/aeolus-configserver.spec.in b/configserver/aeolus-configserver.spec.in
index 7cc7250..465e849 100644
--- a/configserver/aeolus-configserver.spec.in
+++ b/configserver/aeolus-configserver.spec.in
@@ -17,7 +17,7 @@
 
 Name:       aeolus-configserver
 Version:    @VERSION@
-Release:    2%{?dist}
+Release:    1%{?dist}
 Summary:    The Aeolus Config Server
 
 Group:      Applications/System
@@ -169,6 +169,8 @@ fi
 %doc COPYING
 
 %changelog
+* Fri Dec 16 2011 Greg Blomquist <gblomqui at redhat.com> 0.4.4-1
+- https://bugzilla.redhat.com/show_bug.cgi?id=760377
 * Mon Dec 12 2011 Greg Blomquist <gblomqui at redhat.com> 0.4.3-2
 - Fix 500 on audrey-agent HTTP PUT of partial params
 - https://bugzilla.redhat.com/show_bug.cgi?id=766967
diff --git a/configserver/src/config.in.ru b/configserver/src/config.in.ru
index 493064c..2ddb82e 100644
--- a/configserver/src/config.in.ru
+++ b/configserver/src/config.in.ru
@@ -8,21 +8,9 @@ require 'logger'
 $LOGGER = Logger.new(ENV['APPLICATION_LOG'])
 if env == :production
   $LOGGER.level = Logger::INFO
-  set :oauth_ignore_post_body, true
 else
   $LOGGER.level = Logger::DEBUG
   require 'ruby-debug'
-  set :oauth_ignore_post_body, false
-end
-
-# This is an awful hack that needs to go away very soon!
-# In order to make this go away, Conductor needs to use
-# the oauth client to post instance config XML instead of
-# using RestClient
-if env == :production
-  set :oauth_ignore_post_body, true
-else
-  set :oauth_ignore_post_body, false
 end
 
 run Sinatra::Application
diff --git a/configserver/src/lib/application_helper.rb b/configserver/src/lib/application_helper.rb
index 615f823..b608163 100644
--- a/configserver/src/lib/application_helper.rb
+++ b/configserver/src/lib/application_helper.rb
@@ -46,14 +46,26 @@ module ApplicationHelper
   end
 
   def authenticate!
-    if not authenticated?
+    if not authenticated? and not legacy_authenticated?
       logger.debug("  **AUTHENTICATING** NOT AUTHENTICATED! (returning 401)")
       throw :halt, [401, "Not Authorized\n"]
     end
   end
 
   def authenticated?
-    unsigned_parameters = settings.oauth_ignore_post_body ? ["data", "audrey_data"] : []
+    authd?
+  end
+
+  # Attempts to authenticate the request by not including the request body
+  # parameters ("data" or "audrey_data") in the oauth signature validation.
+  # Some older OAuth libraries don't include the request parameters in the OAuth
+  # Signature value for HTTP PUT requests.
+  def legacy_authenticated?
+    authd?(true)
+  end
+
+  def authd?(ignore_request_body=false)
+    unsigned_parameters = ignore_request_body ? ["data", "audrey_data"] : []
     OAuth::Signature.verify(request, :unsigned_parameters => unsigned_parameters) do |request_proxy|
       logger.debug("**AUTHENTICATING** key = #{request_proxy.consumer_key}")
       consumer = ConfigServer::Model::Consumer.find(request_proxy.consumer_key)
diff --git a/configserver/src/spec/spec_helper.rb b/configserver/src/spec/spec_helper.rb
index 5df4a79..0c0475d 100644
--- a/configserver/src/spec/spec_helper.rb
+++ b/configserver/src/spec/spec_helper.rb
@@ -7,7 +7,6 @@ require 'logger'
 ENV['INSTANCE_CONFIG_RNG'] = '../schema/instance-config.rng'
 require 'common_config'
 # HACK, see config.in.ru for details
-set :oauth_ignore_post_body, false
 set :environment, :test
 
 $LOGGER = Logger.new('DEBUG')
-- 
1.7.7.4




More information about the aeolus-devel mailing list