If you want to use basic auth, you can createfirst admin user (with password "admin") like"GET /candlepin/admin/init"
Also, you can use candlepin without any users and disabled basic auth, using OAuth authorization
just adding line like that to candlepin.conf
candlepin.auth.oauth.consumer.domainname.secret=XXXXXXXXXXXself.candlepin_session = requests_oauthlib.OAuth1Session(
self.settings.candlepin_oauth_key, #domainname
client_secret=self.settings.candlepin_secret) #XXXXXXXXXXXAs far, as I understand, tomcat only checks TLS layer, against candlepin public certificate(stored for tomcat in /etc/candlepin/certs/keystore)Sincerely, Stas Fomin.15.02.2016, 18:11, "Lesley Kimmel" <lesley.j.kimmel@gmail.com>:,-LJKThanks,This seems to show that basic (username/password) authentication is disabled. I'm assuming that a specification of some other form (cert) of authentication must fall back to basic if it fails. Where is that configured and where to the users and roles come from?All;I am not a developer so don't fully understand all of the configuration points of apps and Tomcat. I am trying to understand the authN/authZ flow for candlepin. I don't understand why I am prompted for a username and password when accessing http[s]://<server>:<port>/candlepin/<something>. The only places I know to look are web.xml and candlepin.conf. The web.xml only specifies CLIENT-CERT authentication but tomcat is configured only for "clientAuth=want" which shouldn't be mandatory. candlepin.conf has:
candlepin.auth.basic.enable = false
candlepin.auth.trusted.enable = false
candlepin.enable_cert_v3=true
candlepin.auth.oauth.enable = true_______________________________________________
candlepin mailing list
candlepin@lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/candlepin@lists.fedorahosted.org
Sincerely, Stas Fomin--
_______________________________________________
candlepin mailing list
candlepin@lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/candlepin@lists.fedorahosted.org