I don't necessarily want to enable authentication. I am working through a general security guide for Tomcat and I am trying to understand how Candlepin/Gutterball work so that I can make educated decisions of what things I can and cannot change. Right now I'm trying to understand why Candlepin will prompt me for a username/password when basic authentication doesn't seem to be enabled.

-LJK

On Mon, Feb 15, 2016 at 1:47 PM, Stas Fomin <stas-fomin@yandex.ru> wrote:
If you want to use basic auth, you can create
first admin user (with password "admin") like
"GET /candlepin/admin/init"

Also, you can use candlepin without any users and disabled basic auth, using OAuth authorization
just adding line like that to candlepin.conf
candlepin.auth.oauth.consumer.domainname.secret=XXXXXXXXXXX

        self.candlepin_session = requests_oauthlib.OAuth1Session(
                                        self.settings.candlepin_oauth_key,  #domainname
                                        client_secret=self.settings.candlepin_secret)  #XXXXXXXXXXX

 
As far, as I understand, tomcat only checks TLS layer, against candlepin public certificate
(stored for tomcat in  /etc/candlepin/certs/keystore)
 
                  Sincerely, Stas Fomin.
 
 
 
15.02.2016, 18:11, "Lesley Kimmel" <lesley.j.kimmel@gmail.com>:
All;

I am not a developer so don't fully understand all of the configuration points of apps and Tomcat. I am trying to understand the authN/authZ flow for candlepin. I don't understand why I am prompted for a username and password when accessing http[s]://<server>:<port>/candlepin/<something>. The only places I know to look are web.xml and candlepin.conf. The web.xml only specifies CLIENT-CERT authentication but tomcat is configured only for "clientAuth=want" which shouldn't be mandatory. candlepin.conf has:

candlepin.auth.basic.enable = false
candlepin.auth.trusted.enable = false
candlepin.enable_cert_v3=true
candlepin.auth.oauth.enable = true

This seems to show that basic (username/password) authentication is disabled. I'm assuming that a specification of some other form (cert) of authentication must fall back to basic if it fails. Where is that configured and where to the users and roles come from?

Thanks,
-LJK
,

_______________________________________________
candlepin mailing list
candlepin@lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/candlepin@lists.fedorahosted.org

 
 

Sincerely, Stas Fomin
-- 
 
 
 

_______________________________________________
candlepin mailing list
candlepin@lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/candlepin@lists.fedorahosted.org