Issue #477
closed
python-kombu does not work with Qpid unless the user adjusts qpidd.conf
Description
Currently, the python-kombu behavior only works if the user does 1 of 2 things.
a) Disable authentication by putting 'auth=no' in qpidd.conf
b) Properly configures SASL by installing packages and configuring them
This is a barrier to using Pulp right away because the python-kombu does not align with the vanilla configuration Qpid has out of the box.
The root cause is that the Qpid transport only supports PLAIN authentication instead of ANONYMOUS. To fix this I propose the following:
1) Add ANONYMOUS as a default authentication type in addition to PLAIN in python-kombu
2) Test the adjusted python-kombu with a vanilla, unconfigured Qpid install
3) Update the tests to match this change
4) Update the Pulp docs some so they identify that the default setup uses ANONYMOUS auth, but that the user can also configure SASL for username/password auth.
+ This bug was cloned from Bugzilla Bug #1124589 +
Updated by bmbouter almost 10 years ago
Two users on the mailing list indicated they spent a lot of time as a result of this not being fixed. I'm moving it to 2.5.1 with high priority.
+ This comment was cloned from Bugzilla #1124589 comment 1 +
Updated by bmbouter almost 10 years ago
After looking more into this, this should work today if the user makes no changes to the qpidd.conf and has cyrus-sasl-plain installed, except that Qpid doesn't create the SASL DB with guest/guest as it says it does.
I've filed an upstream issue [0] with Qpid on this, but we should still enable ANONYMOUS auth. The reasons I have are these:
1) a SASL auth that uses guest/guest is no more secure than ANONYMOUS auth
2) ANONYMOUS achieves the out of the box experience we are looking for
3) upstream kombu doesn't have a mechanism to bundle cyrus-sasl-plain automatically so their unboxing experience will still require thought, reading, and effort
+ This comment was cloned from Bugzilla #1124589 comment 2 +
Updated by bmbouter almost 10 years ago
Through discussion in IRC, upstream Qpid will likely remove the docs statements that claim that they configure a simple SASL DB for the users. That double-ly supports the idea of us allowing ANONYMOUS because Qpid literally only works with ANONYMOUS out of the box.
+ This comment was cloned from Bugzilla #1124589 comment 3 +
Updated by cduryee almost 10 years ago
https://github.com/pulp/pulp/pull/1153
+ This comment was cloned from Bugzilla #1124589 comment 4 +
Updated by cduryee almost 10 years ago
merged to pulp/kombu and pulp/pulp (2.5-dev and master)
+ This comment was cloned from Bugzilla #1124589 comment 5 +
Updated by bmbouter almost 10 years ago
The actual PR for this was made later, and is: https://github.com/pulp/pulp/pull/1165
+ This comment was cloned from Bugzilla #1124589 comment 6 +
Updated by cduryee almost 10 years ago
fixed in pulp 2.6.0-0.2.beta
+ This comment was cloned from Bugzilla #1124589 comment 7 +
Updated by pthomas@redhat.com almost 10 years ago
verified
pulp server works without having to make auth=no ins qpidd.conf
Tested in el6 & el7
+ This comment was cloned from Bugzilla #1124589 comment 8 +
Updated by rbarlow over 9 years ago
- Status changed from 6 to CLOSED - CURRENTRELEASE
.