On Wed, 2011-08-03 at 19:43 -0400, Dmitri Pal wrote:
On 08/03/2011 10:45 AM, Mark McLoughlin wrote:
> On Fri, 2011-07-29 at 18:57 +0100, Martyn Taylor wrote:
>> We intend to use OAuth across components for authentication. This
>> would require adding OAuth Provider support to conductor and OAuth
>> client support to each component accessing protected resources.
>> Katello already supports a OAuth (two-legged) which hopefully means
>> relatively straight forward integration once we have the other parts
>> in place.
> I think there's been some confusion about OAuth, what Katello uses it
> for and what we would use it for.
> In Katello's case, it is actually an OAuth consumer and uses it when
> authenticating against Candlepin and Pulp's REST APIs.
> Two-legged means that Candlepin/Pulp don't authenticate a user, but
> rather authenticate Katello using a shared secret. Katello passes
> Candlepin/Pulp the username via a HTTP header.
> IMHO, the comparable case for us is Conductor authenticating against
> IWHD and Image Factory.
Exactly! I am just struggling with understanding why and how it is
better than say SSL?
Is it faster? Is there a good key management infrastructure and tools?
If yes - great if no should we be worried about this and pick other
credentials that we already have tools for?
I assume two legged OAuth was chosen over X.509 client certificates
purely for the sake of simplicity.