Enable RHSM certguard tests under domains - #7964
Conversation
| # Strip the /{domain} segment: /domain/rest... -> /rest... | ||
| path_without_content_path_prefix = ( | ||
| "/" + path_without_content_path_prefix.lstrip("/").split("/", 1)[1] | ||
| ) |
There was a problem hiding this comment.
I'm not 100% sure this is correct? In theory this would match paths across different domains - which seems like it would be wrong - but then perhaps there are other guards preventing users from accessing those other domains?
The entitlements are created externally though so changing the entitlements to include a domain is not something we can decide ourselves. And it seems like at the moment certguards and domains are incompatible.
There was a problem hiding this comment.
Claude says
RHSM entitlement certificates are issued by Candlepin/Katello, which is external to Pulp and has no concept of Pulp domains. The paths embedded in the cert look like
/Default_Organization/Library/content/dist/rhel/...— they describe the subscription content hierarchy, not Pulp's URL routing structure.
edit: per project discussion, we think this might be OK, because the certguard itself exists only within a given domain, so you cannot really have a situation where a user can re-use an entitlement certificate across domains unless the certguard on both domains was explicitly configured to trust the same issuer.
We already strip off the content path prefix here, and anything before it e.g. fqdn is ignored.
With that said I guess you could say that inability to issue domain-specific entitlements could be an issue, but maybe not a common one? Would it even be a good idea to share the same issuing CA for certguards across domains? Certainly not with this limitation, but in general too, perhaps?
The RHSM certguard strips CONTENT_PATH_PREFIX from request.path to
match against entitlement paths in the certificate. With domains, the
path includes a /{domain}/ segment after the prefix that was not being
stripped, causing all RHSM path checks to fail.
Limitation: the domain cannot be used to scope an entitlement to a
specific domain via the path. If the same issuer CA is trusted by content
guards in two domains, an entitlement certificate is honored in both. For
per-domain isolation, trust a distinct issuer (CA) per domain rather than
relying on domain-specific entitlement certificates.
Assisted-By: Claude Opus 4.6
d198d64 to
a957d78
Compare
ggainey
left a comment
ggainey
left a comment
There was a problem hiding this comment.
Looks good, based on our current understanding and discussions.
|
Awaiting a 2nd review from Matthias, don't merge plz |
3 participants
📜 Checklist
See: Pull Request Walkthrough