...consider also looking up the name based on the version without the
domain in it, perhaps.
We're using Kerberos and it always passes user as <hostname>@<REALM>.
(I didn't include that in the example because I didn't want to muddy the waters)
So unless you know how to get mod_auth_kerb to pass user name without
that part, your suggestion is not an option.
I guess I can modify remote.py to strip it out.
I'm not a python coder.
Can anyone show me a line of code that does that?
On Fri, Aug 14, 2009 at 6:43 AM, Michael DeHaan<mdehaan(a)redhat.com> wrote:
On 08/13/2009 09:45 PM, Paul Company wrote:
> Running Cobbler 1.6.6 on RHEL 5.3
>
> Here's the configuation:
>
> # vi /etc/cobbler/modules.conf
> [authentication]
> module = authn_configfile
>
> [authorization]
> module = authz_ownership
> :wq!
>
> # htdigest /etc/cobbler/users.digest "Cobbler" pcompany
> Adding user pcompany in realm Cobbler
> New password: yaba
> Re-type new password: yaba
> # htdigest /etc/cobbler/users.digest "Cobbler" pcompany(a)EXAMPLE.COM
> New password: daba
> Re-type new password: daba
>
> # vi /etc/cobbler/users.conf
> [admins]
> admin = ""
> cobbler = ""
> pcompany = ""
> pcompany(a)EXAMPLE.COM = ""
> :wq!
>
> # vi /etc/httpd/conf.d/cobbler.conf
> <Directory "/var/www/cobbler/web/">
> AuthType Basic
> AuthName Cobbler
> Require valid-user
> SetHandler mod_python
> PythonAuthenHandler index
> PythonHandler index
> PythonPath "sys.path + ['/var/www/cobbler/web/']"
> PythonDebug on
> </Directory>
> :wq!
>
> # /etc/init.d/cobblerd restart
> # /etc/init.d/httpd restart
>
> Browse to the Web UI and login as (A) pcompany and (B) pcompany(a)EXAMPLE.COM:
> (A1) Logging in as pcompany works fine. Authentication works.
> (A2) Authorization for pcompany works.
> pcompany has full permissions to
> list/copy/modify/new/remove/save on distros, profiles, systems, repos,
> kickstarts
> This is because user.conf is parsed correctly and it finds pcompany.
> (B1) Logging in as pcompany(a)EXAMPLE.COM works fine. Authentication works.
> (B2) Authorization for pcompany(a)EXAMPLE.COM fails!
> This is because user.conf is parsed incorrectly and it can not
> find pcompany(a)EXAMPLE.COM
>
> Here's what's left in the log, see line 1044
> # cat /var/log/cobbler/cobblerd.log
> 2009-08-13 17:37:56,905 - api - login attempt; user(pcompany(a)EXAMPLE.COM)
> 2009-08-13 17:37:56,905 - api - authenticate; ['pcompany(a)EXAMPLE.COM',
> 'big long encryption string']
> 2009-08-13 17:37:56,906 - api - login succeeded; user(pcompany(a)EXAMPLE.COM)
> 2009-08-13 17:37:57,035 - api - calling authorize for resource
> ['new_system', None, None]; user(pcompany(a)EXAMPLE.COM)
> 2009-08-13 17:37:57,035 - api - Exception occured: cobbler.cexceptions.CX
> 2009-08-13 17:37:57,035 - api - Exception value: 'user does not have
> access to resource: new_system'
> 2009-08-13 17:37:57,036 - api - Exception Info:
> File "/usr/lib/python2.4/site-packages/cobbler/remote.py", line
> 1000, in check_access_no_fail
> self.check_access(token,resource,arg1,arg2)
> File "/usr/lib/python2.4/site-packages/cobbler/remote.py", line
> 1013, in check_access
> rc = self.__authorize(token,resource,arg1,arg2)
> File "/usr/lib/python2.4/site-packages/cobbler/remote.py", line
> 1044, in __authorize
> raise CX(_("user does not have access to resource: %s") % resource)
>
> Can anyone think of a quick fix?
> I'm assuming it's choking on the @ symbol.
> I tried quoting it, but that didn't work.
> We probably have to modify /usr/lib/python2.4/site-packages/cobbler/remote.py?
> Or whatever python module parses users.conf?
> _______________________________________________
> cobbler-devel mailing list
> cobbler-devel(a)lists.fedorahosted.org
>
https://fedorahosted.org/mailman/listinfo/cobbler-devel
>
Replied to the post on the main list...
If we think there is a bug in ConfigParser we should isolate it with a
simple test program and then perhaps consider also looking up the name
based on the version without the domain in it, perhaps.
--Michael
_______________________________________________
cobbler-devel mailing list
cobbler-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/cobbler-devel