Pulp

The Basic auth is currently submitted via a header. Do we need more than that?

The goal was to support auth via a client certificate rather than basic auth. We could accomplish this by using a web server like apache to do the client cert verification and tell it to put the CN into a header, which the application will look for. This is a common paradigm and we use it today with pulp 2.

@jsherrill what you're describing sounds like exactly what we're making for ContentGuards. That's the new name for the "content protection" feature of Pulp2. The epic for that work is #3968 and the specific Oid content guard port from Pulp2 is #4009.

That feature is only for the content portion of the WSGI app; the rest of the API calls (non-content calls) use Basic auth currently. For those non-content calls, Is having a cert more useful for you than basic auth somehow?

Tested and validated that this works as anticipated.

The default behavior of the RemoteUserBackend is to create a new user in django when the remote-user is unknown. As prescribed by [1] we'd need to override this behavior in a custom class.

[1] https://docs.djangoproject.com/en/2.1/ref/contrib/auth/#django.contrib.auth.backends.RemoteUserBackend

diff --git a/pulpcore/app/auth/__init__.py b/pulpcore/app/auth/__init__.py
index e69de29bb..a577e27ce 100644
--- a/pulpcore/app/auth/__init__.py
+++ b/pulpcore/app/auth/__init__.py
@@ -0,0 +1 @@
+from .backends import RemoteUserBackend  # noqa

diff --git a/pulpcore/app/auth/backends.py b/pulpcore/app/auth/backends.py
index e69de29bb..ab4a1d74f 100644
--- a/pulpcore/app/auth/backends.py
+++ b/pulpcore/app/auth/backends.py
@@ -0,0 +1,5 @@
+from django.contrib.auth import backends
+
+
+class RemoteUserBackend(backends.RemoteUserBackend):
+    create_unknown_user = False

Apache configuration used for testing.

WSGIScriptAlias /pulp/api/v3 /srv/pulp/wsgi.py/pulp/api/v3

<Directory /srv/pulp>
  Require all granted
</Directory>

<Files wsgi.py>
  SSLRenegBufferSize  1048576
  SSLVerifyDepth 9
  SSLOptions +StdEnvVars +ExportCertData
  SSLVerifyClient optional_no_ca
  RewriteEngine on
  RewriteRule .* - [E=REMOTE_USER:%{SSL:SSL_CLIENT_S_DN_CN}]
</Files>

The django settings needs to be altered when using REMOTE-USER as follows:

/etc/pulp/settings.py needed to re-configure django auth.

from pulpcore.app import settings

REST_FRAMEWORK = settings.REST_FRAMEWORK
REST_FRAMEWORK['DEFAULT_AUTHENTICATION_CLASSES'] = (
    'rest_framework.authentication.BasicAuthentication',
    'rest_framework.authentication.RemoteUserAuthentication',
)

AUTHENTICATION_BACKENDS = [
    'pulpcore.app.auth.RemoteUserBackend',
]

This replaces the SessionAuthentication with RemoteUserAuthentication. Apache should be responsible for any session management including CSRF, right? If not, I don't know how to resolve "CRSF token missing or incorrect" errors.

Should I proceed with a PR to add the docs and custom RemoteUserBackend?

Where should the documentation go? And, what should be documented that is not redundant to django docs?

My 2 cents:

Any supported options in settings.py should be documented in the pulp docs. Being a django developer/admin should not be a prerequisite to deploying pulp3 IMO.