Project

Profile

Help

Issue #477

closed

python-kombu does not work with Qpid unless the user adjusts qpidd.conf

Added by bmbouter about 7 years ago. Updated about 3 years ago.

Status:
CLOSED - CURRENTRELEASE
Priority:
High
Assignee:
Category:
-
Sprint/Milestone:
-
Start date:
Due date:
Estimated time:
Severity:
2. Medium
Version:
2.4 Beta
Platform Release:
2.6.0
OS:
Triaged:
Yes
Groomed:
No
Sprint Candidate:
No
Tags:
Pulp 2
Sprint:
Quarter:

Description

Currently, the python-kombu behavior only works if the user does 1 of 2 things.

a) Disable authentication by putting 'auth=no' in qpidd.conf
b) Properly configures SASL by installing packages and configuring them

This is a barrier to using Pulp right away because the python-kombu does not align with the vanilla configuration Qpid has out of the box.

The root cause is that the Qpid transport only supports PLAIN authentication instead of ANONYMOUS. To fix this I propose the following:

1) Add ANONYMOUS as a default authentication type in addition to PLAIN in python-kombu
2) Test the adjusted python-kombu with a vanilla, unconfigured Qpid install
3) Update the tests to match this change
4) Update the Pulp docs some so they identify that the default setup uses ANONYMOUS auth, but that the user can also configure SASL for username/password auth.

+ This bug was cloned from Bugzilla Bug #1124589 +

Actions #1

Updated by bmbouter about 7 years ago

Two users on the mailing list indicated they spent a lot of time as a result of this not being fixed. I'm moving it to 2.5.1 with high priority.

+ This comment was cloned from Bugzilla #1124589 comment 1 +

Actions #2

Updated by bmbouter about 7 years ago

After looking more into this, this should work today if the user makes no changes to the qpidd.conf and has cyrus-sasl-plain installed, except that Qpid doesn't create the SASL DB with guest/guest as it says it does.

I've filed an upstream issue [0] with Qpid on this, but we should still enable ANONYMOUS auth. The reasons I have are these:

1) a SASL auth that uses guest/guest is no more secure than ANONYMOUS auth
2) ANONYMOUS achieves the out of the box experience we are looking for
3) upstream kombu doesn't have a mechanism to bundle cyrus-sasl-plain automatically so their unboxing experience will still require thought, reading, and effort

+ This comment was cloned from Bugzilla #1124589 comment 2 +

Actions #3

Updated by bmbouter about 7 years ago

Through discussion in IRC, upstream Qpid will likely remove the docs statements that claim that they configure a simple SASL DB for the users. That double-ly supports the idea of us allowing ANONYMOUS because Qpid literally only works with ANONYMOUS out of the box.

+ This comment was cloned from Bugzilla #1124589 comment 3 +

Actions #5

Updated by cduryee about 7 years ago

merged to pulp/kombu and pulp/pulp (2.5-dev and master)

+ This comment was cloned from Bugzilla #1124589 comment 5 +

Actions #6

Updated by bmbouter about 7 years ago

The actual PR for this was made later, and is: https://github.com/pulp/pulp/pull/1165

+ This comment was cloned from Bugzilla #1124589 comment 6 +

Actions #7

Updated by cduryee about 7 years ago

fixed in pulp 2.6.0-0.2.beta

+ This comment was cloned from Bugzilla #1124589 comment 7 +

Actions #8

Updated by pthomas@redhat.com about 7 years ago

verified
pulp server works without having to make auth=no ins qpidd.conf
Tested in el6 & el7

+ This comment was cloned from Bugzilla #1124589 comment 8 +

Actions #9

Updated by rbarlow about 7 years ago

  • Status changed from 6 to CLOSED - CURRENTRELEASE
Actions #11

Updated by bmbouter about 3 years ago

  • Severity set to 2. Medium
Actions #12

Updated by bmbouter about 3 years ago

  • Tags Pulp 2 added

Also available in: Atom PDF