Hi Pete,
On Tue, Sep 20, 2011 at 11:17:30PM -0600, Pete Zaitcev wrote:
I see, thanks. However, another question. Is there a document that
explains
what fields should be used in the rest of Aeolus (e.g. implemented by Matt,
and by myself -- if we committ to it in iwhd). For example, Google feels
like saying "The oauth_token query parameter should not be used." Neither
is realm used, but they mandate xoauth_requestor_id. And here?
In Ruby, we're using the ruby-oauth gem[1], which abstracts away some of
the details of the implementation from us.
Yesterday I got Conductor to acts as a consumer of Katello. (Well,
mostly.) The code we have essentially just instantiates a new OAuth
"consumer" object that needs to know the consumer_key and the
consumer_secret, which are set in a Katello config file. We can then use
this to make requests. We also pass in a "katello-user" header to
indicate which user we are authenticating.
I should at this point disclaim that most of this is fairly new to me as
well, so don't take any of this as infallible doctrine. Clear
documentation has been frustratingly scarce -- everything is either a
high-level overview of OAuth for complete beginners, or it's something
like the RFC that is perhaps a bit more advanced than I was looking for.
For the sake of demonstration (and for the sake of me understanding
what's going on under the hood a little better), I just pointed that
client at iwhd on localhost instead. I used a consumer key of 'key' and
a consumer secret of 'secret', and requested /images.
The bit that took me a little bit to understand after reading so much
about three-legged OAuth with multiple key and token exchanges is that
none of that happens here. We "get" the consumer key and consumer secret
by having me open katello.yml and vim and copy-and-paste them into our
config file. (The consumer key and consumer secret in two-legged OAuth
can almost be thought of as a username/password pair, though obviously
we don't send the secret over the wire.)
The request was a normal HTTP/1.1 GET for /images, but with this
additional header (sorry for formatting, it was on one line):
OAuth oauth_consumer_key=\"key\",
oauth_nonce=\"YmVAS1PizWzvM5KtTv9c2IcgsKJSueqDHaFy55yD3Q\",
oauth_signature=\"KALNY1CbUXRYaxdFsuhRiTnzqcU%3D\",
oauth_signature_method=\"HMAC-SHA1\", oauth_timestamp=\"1316612255\",
oauth_version=\"1.0\"
The oauth gem handles the generation of the nonce and signature for us.
Server-side, Katello essentially uses the OAuth gem to validate that the
signature for consumer_key is valid for the one in the configuration
file. If so, it considers the request authenticated. (In the case of
Katello, we also set a "Katello-user" HTTP header and use that value,
but I don't think this applies to iwhd.) The source for this can be seen
at [2]. (Note that this was done by the Katello team, not me, and that
the link isn't to the official Katello repo, either.)
Also, what do you use as a test client when hacking on servers?
Is there a mode for curl, or...? A simple client is required for iwhd
because of our committment to build-time regression testing. Currently
we get by with curl(1) invoked from shell scripts.
I'm not entirely sure yet. I suspect we can just use the Ruby gem for
testing against a mocked set of requests or responses. Sorry that this
isn't a terribly helpful response.
Hope this helps,
Matt
[1]
https://github.com/oauth/oauth-ruby
[2]
https://github.com/ohadlevy/katello/blob/master/src/config/initializers/w...