On Wed, Aug 03, 2011 at 11:27:04AM -0400, Bryan Kearney wrote:
On 08/03/2011 10:45 AM, Mark McLoughlin wrote:
> On Fri, 2011-07-29 at 18:57 +0100, Martyn Taylor wrote:
>> We intend to use OAuth across components for authentication. This
>> would require adding OAuth Provider support to conductor and OAuth
>> client support to each component accessing protected resources.
>> Katello already supports a OAuth (two-legged) which hopefully means
>> relatively straight forward integration once we have the other parts
>> in place.
>
> I think there's been some confusion about OAuth, what Katello uses it
> for and what we would use it for.
>
> In Katello's case, it is actually an OAuth consumer and uses it when
> authenticating against Candlepin and Pulp's REST APIs.
>
> Two-legged means that Candlepin/Pulp don't authenticate a user, but
> rather authenticate Katello using a shared secret. Katello passes
> Candlepin/Pulp the username via a HTTP header.
>
> IMHO, the comparable case for us is Conductor authenticating against
> IWHD and Image Factory.
>
As well as Katello -> Conductor and Conductor -> Katello.
Yes.
To be clear, I think we may be able to get away with no authorization
in the warehouse at all -- at least until someone proves to me we need
it.
If Conductor is the only thing that talks to the warehouse and the
factory, and we think the ability of an admin to add or remove items
from a Conductor catalog is sufficient access control for images (I
do), then we don't really need warehouse to do authentication at all
-- we just need to secure the connection.
--Hugh
--
== Hugh Brock, hbrock(a)redhat.com ==
== Engineering Manager, Cloud BU ==
== Aeolus Project: Manage virtual infrastructure across clouds. ==
==
http://aeolusproject.org ==
"I know that you believe you understand what you think I said, but I’m
not sure you realize that what you heard is not what I meant."
--Robert McCloskey