Uploaded image for project: 'Satellite'
  1. Satellite
  2. SAT-12594

Kerberos authentication fails for POST, PUT and DELETE api calls

XMLWordPrintable

    • Important

      Description of problem:
      POST, PUT and DELETE calls fail with "Unable to authenticate user" when using kerberos authentication. At the same time, GET calls pass without any issues.

      Version-Release number of selected component (if applicable):
      6.12.0 snap 8

      How reproducible:
      always

      Steps to Reproduce:
      1. Have a Satellite configured for Kerberos authentication.
      2. Run kinit <someuser> to get ticket.
      3. Call /extlogin to get session_id and store it in a cookie file:

      1. curl -k -c cookies.txt -u : --negotiate https://satellite.redhat.com/users/extlogin
        4. Using the cookie file try GET call to some endpoint, it works:
      2. curl -b cookies.txt -H "Accept:application/json,version=2" -H "Content-Type:application/json" -X GET -k https://satellite.redhat.com/api/architectures
        5. Using the same cookie file try POST/PUT/DELETE call to create/update/delete an entity:
      3. curl -b cookies.txt -H "Accept:application/json,version=2" -H "Content-Type:application/json" -X POST -d ' {"name":"8051"}

        ' -k https://satellite.redhat.com/api/architectures

      Actual results:

      It fails with this response:
      {
      "error":

      {"message":"Unable to authenticate user "}

      }

      In the production log we can see:
      2022-08-30T04:38:23 [I|app|0dd98e4b] Started POST "/api/architectures" for 10.11.12.13 at 2022-08-30 04:38:23 -0400
      2022-08-30T04:38:23 [I|app|0dd98e4b] Processing by Api::V2::ArchitecturesController#create as JSON
      2022-08-30T04:38:23 [I|app|0dd98e4b] Parameters: {"name"=>"8051", "apiv"=>"v2", "architecture"=>{"name"=>"8051"}}
      2022-08-30T04:38:23 [W|app|0dd98e4b] Can't verify CSRF token authenticity.
      2022-08-30T04:38:23 [I|app|0dd98e4b] Rendering api/v2/errors/unauthorized.json.rabl within api/v2/layouts/error_layout
      2022-08-30T04:38:23 [I|app|0dd98e4b] Rendered api/v2/errors/unauthorized.json.rabl within api/v2/layouts/error_layout (Duration: 6.9ms | Allocations: 6931)
      2022-08-30T04:38:23 [I|app|0dd98e4b] Filter chain halted as :authorize rendered or redirected
      2022-08-30T04:38:23 [I|app|0dd98e4b] Completed 401 Unauthorized in 14ms (Views: 11.1ms | ActiveRecord: 0.5ms | Allocations: 13914)

      Expected results:
      Successful authentication, entity created/updated/deleted

      Additional info:
      This issue impacts the hammer CLI functionality too.

            ofedoren@redhat.com Oleh Fedorenko
            jira-bugzilla-migration RH Bugzilla Integration
            Lukas Hellebrandt Lukas Hellebrandt
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: