On 02/15/2016 03:26 PM, Lesley Kimmel wrote:
I am, for example, accessing
"https://<server>:8443/candlepin/products". You are correct it does
not appear that putting something in this form will succeed.
However, I guess I don't know what user(s) I might even try to
use.
I don't know if it matters but this Candlepin installation is part
of Katello/Satellite. Maybe that even goes without saying I am
still trying to understand the relationships between the various
components.
I would guess that by accessing it as I did above I am going
straight to the Candlepin application deployed to Tomcat. I'm sure
the Katello piece is using a certificate which Candlepin is
configured to trust.
I'm also curious how the authN piece works since Tomcat is
configured with "want" which, from what I understand will still
allow access to the application while passing a null certificate.
Is Candlepin doing its own validation of the cert after Tomcat does
its part? ________________________________________ candlepin
mailing list candlepin(a)lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/candlepin@lists.fedorahosted.org
With a Katello installation, Candlepin is generally set up to only use
client certificate authentication and OAuth. Katello uses OAuth while
registered consumers use certificate authentication. If you want to
enable basic authentication and create a user, I can provide
instructions on that. The users themselves are in Candlepin's
postgresql database under cp_user in a standalone Candlepin instance,
but I seem to recall that Katello may implement its own user interface
and integrate that with Candlepin.
To explain the relationships, Katello runs over top of Candlepin and
provides its own REST API. Many of the calls are forwarded directly
on to Candlepin, but in some cases Katello intercepts the calls and
performs additional work. Think of Candlepin as just an engine.
Katello is the car portion. You can interact directly with the engine
of course, but it's tedious.
To answer your question about Tomcat and the null certificate, you are
correct in suspecting that Candlepin does it's own certificate
validation after Tomcat. We do this to allow multiple forms of
authentication and we also need some information out of the
certificate (namely the CN).
-------------
Regards,
Alex