Hey,
On Wed, 2011-09-14 at 15:49 -0600, Pete Zaitcev wrote:
On Wed, 14 Sep 2011 19:22:00 +0100
Mark McLoughlin <markmc(a)redhat.com> wrote:
> 4) iwhd and Image Factory would be configured to only accept
> connections from Conductor - e.g. using two-legged OAuth like
> Katello does with Candlepin and Pulp
Thanks, Mark. I'll read on OAuth and estimate how much that would take.
Kerberos was very little code on top of a lot of reading. I think I
plugged on it for a month at least, maybe more.
Here's what I managed to get from looking at Katello's usage of OAuth
for similar purposes.
* Despite all the dire warnings of OAuth 1.0 being a terrible protocol,
that does appear to be what we're using:
http://tools.ietf.org/html/rfc5849
* Katello uses this ruby gem for the consumer side:
https://github.com/oauth/oauth-ruby
* And here's how it builds the Authorization header:
# New OAuth consumer to setup signing the request
consumer = OAuth::Consumer.new(self.consumer_key,
self.consumer_secret,
params)
# The type is passed in, GET/POST/PUT/DELETE
request = http_type.new(url)
# Sign the request with OAuth
consumer.sign!(request)
# Extract the header and add it to the RestClient
added_header = {'Authorization' => request['Authorization']}
* Pulp authenticates clients using the python-oauth2 library:
http://pypi.python.org/pypi/oauth2/
* Here's how it does it:
consumer = oauth2.Consumer(key=key, secret=secret)
server = oauth2.Server()
server.add_signature_method(oauth2.SignatureMethod_HMAC_SHA1())
try:
# this call has a return value, but failures are noted by the exception
server.verify_request(req, consumer, None)
except oauth2.Error, e:
_log.error('error verifying OAuth signature: %s' % e)
return None
* Candlepin, on the provider side, uses the Java library from here:
http://code.google.com/p/oauth/
* And here's the code:
protected static final OAuthValidator VALIDATOR = new SimpleOAuthValidator();
...
if (AuthUtil.getHeader(request,
"Authorization").contains("oauth")) {
OAuthMessage requestMessage = new RestEasyOAuthMessage(request);
OAuthAccessor accessor = this.getAccessor(requestMessage);
// TODO: This is known to be memory intensive.
VALIDATOR.validateMessage(requestMessage, accessor);
// If we got here, it is a valid oauth message.
...
protected OAuthAccessor getAccessor(OAuthMessage msg) {
try {
OAuthAccessor accessor = accessors.get(msg.getConsumerKey());
...
protected void setupAccessors() {
...
OAuthConsumer consumer = new OAuthConsumer("", consumerName,
sekret, null);
OAuthAccessor accessor = new OAuthAccessor(consumer);
accessors.put(consumerName, accessor);
* Katello has a script to generate the secret and configure Katello,
Candlepin and Pulp with it:
http://git.fedorahosted.org/git/?p=katello.git;a=blob;f=src/script/reset-...
Cheers,
Mark.