<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>We had discussed base64 encoding the cert in the webserver on the
way in and then letting cert guard decode it. While that's not
ideal I think it has some advantages over moving the full auth
into the webserver. What was your motivation for going with that
approach over the base64 encoding approach? <br>
</p>
<div class="moz-cite-prefix">On 3/11/20 2:11 PM, Brian Bouterse
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAAcvrTFMmN=7TUpT=L_r8+2hOFqy=SoEi9FcMnxgV-FYqK+nfQ@mail.gmail.com">
<div dir="ltr">
<div>tl;dr: What we have today cannot work with rhsm
certificates which Katello uses. To resolve, we need to have
content guard checking moved to the webserver configs for
apache and nginx and not done in pulp-content as it is today.
<a href="https://pulp.plan.io/issues/6323"
moz-do-not-send="true">https://pulp.plan.io/issues/6323</a></div>
<div><br>
</div>
<div>We need to bring the auth to where TLS is terminated
because we can't being the client certs to pulp-content due to
invalid header characters. As is, pulp-certguard cannot work
with Katello's cert types (rhsm certs) so that is driving my
changes.</div>
<div><br>
</div>
<div>If anyone has major concerns or other ideas please let me
know. In the meantime I'm proceeding moving the authorization
to the webserver and then updating pulp-certguard to work with
that. This will make pulp-certguard's GA tied to pulpcore
3.3.0. Feedback is welcome.<br>
</div>
<div><br>
</div>
<div>[0]: <a href="https://pulp.plan.io/issues/6323"
moz-do-not-send="true">https://pulp.plan.io/issues/6323</a><br>
<br>
</div>
<div>Thanks,</div>
<div>Brian<br>
</div>
<div><br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Pulp-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Pulp-dev@redhat.com">Pulp-dev@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/pulp-dev">https://www.redhat.com/mailman/listinfo/pulp-dev</a>
</pre>
</blockquote>
</body>
</html>