Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes #37308 - set REMOTE_USER properly for pulpcore registry #337

Merged
merged 1 commit into from
Apr 11, 2024

Conversation

ianballou
Copy link
Contributor

@ianballou ianballou commented Mar 28, 2024

Changes the /pulpcore_registry/v2/ reverse proxy's REMOTE_USER designation so that it always matches the Pulp admin user. Since we use Pulp's remote authentication, the REMOTE_USER must always return 'admin' since that is the only user Katello ever interacts with in Pulp.

The goal is to have the location definition look like:

  <Location "/pulpcore_registry/v2/">
    RequestHeader unset REMOTE_USER
    RequestHeader set REMOTE_USER "admin" "expr=%{SSL_CLIENT_S_DN_CN} == 'centos8-katello-devel.example.com'"
    ProxyPass unix:///run/pulpcore-api.sock|http://pulpcore-api/v2/
    ProxyPassReverse unix:///run/pulpcore-api.sock|http://pulpcore-api/v2/
  </Location>

As currently defined, the REMOTE_USER does not get set and Pulp cannot authenticate requests to push container content to the registry.

To test, you could patch in my changes to a Katello production install and re-run the installer.

@ianballou ianballou force-pushed the 37308-apache-container-push branch from 4a5c71b to 787ca73 Compare April 2, 2024 17:29
@ehelms ehelms merged commit 21aa39e into theforeman:master Apr 11, 2024
13 checks passed
@ehelms ehelms added the Enhancement New feature or request label Apr 11, 2024
@ianballou ianballou deleted the 37308-apache-container-push branch April 11, 2024 13:58
@ekohl ekohl added Bug Something isn't working and removed Enhancement New feature or request labels May 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants