[jbosstools-issues] [JBoss JIRA] (JBIDE-15830) openshift-java-client: incompatibility with OpenShift Enterprise and Origin when using the remote-user authentication plugin
Brenton Leanhardt (JIRA)
jira-events at lists.jboss.org
Wed Nov 13 17:26:05 EST 2013
[ https://issues.jboss.org/browse/JBIDE-15830?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12923309#comment-12923309 ]
Brenton Leanhardt commented on JBIDE-15830:
-------------------------------------------
There are a few things wrong right now. In RestServiceProperties.java:54 the logic is such that if cliendId is null then the user agent is never set. This is why we're getting the default JVM user-agent. I verified with jdb that at https://github.com/openshift/jenkins-cloud-plugin/blob/enterprise-2.0/src/main/java/hudson/plugins/openshift/OpenShiftCloud.java#L172 the 'username' is null. The first field is actually supposed to be the clientid. I fixed that a part of the plugin and now authentication is working. However, I've so brutally hacked up this dev environment trying to debug things I appear to have broken some other part of the jenkins build process. I'll debug with a fresh brain tomorrow but I think at this point we have a clear idea what's going on.
For what it's worth, I found no code in openshift-java-client that was actually reading the clientid from the properties file.
> openshift-java-client: incompatibility with OpenShift Enterprise and Origin when using the remote-user authentication plugin
> ----------------------------------------------------------------------------------------------------------------------------
>
> Key: JBIDE-15830
> URL: https://issues.jboss.org/browse/JBIDE-15830
> Project: Tools (JBoss Tools)
> Issue Type: Bug
> Components: openshift
> Affects Versions: 4.1.1.Beta1
> Reporter: Brenton Leanhardt
> Assignee: Andre Dietisheim
> Labels: openshift-java-client
> Fix For: 4.1.1.CR1, 4.2.0.Alpha1
>
>
> OpenShift Enterprise and Origin both ship an authentication plugin that allows parts of authentication to be handled by Apache and other parts to be delegated to the openshift-origin-controller codebase. I've found that all versions of openshift-java-client after 2.3.0.Final change a (poorly documented) requirement for the OpenShift remote-user plugin.
> In order for a request to bypass the Apache authentication and passthrough to the OpenShift Broker the user-agent header is inspected. If the user-agent is 'OpenShift' then the Broker will require an encrypted authentication token. Today this is used by the jenkins cartridge but I believe it's also still used for scaling.
> You can see this for details:
> https://github.com/openshift/origin-server/blob/master/documentation/archive/how_nodes_act_on_behalf_of_users.md#how-the-encrypted-token-is-used
> In 2.3.0.Final of the openshift-java-client the user-agent was 'OpenShift' however all versions after this set the user-agent to the java version (eg, User-Agent: Java/1.7.0_45).
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
More information about the jbosstools-issues
mailing list