Red Hat Summit Red Hat SummitSuporteConsoleDesenvolvedoresComeçar um testeContato

Este conteúdo não está disponível no idioma selecionado.

Chapter 3. Authenticating API Calls

Interaction with the Satellite API requires SSL authentication with Satellite Server CA certificate and authentication with valid Satellite user credentials. This chapter outlines the authenticating methods you can use.

3.1. SSL Authentication Overview
Copiar o link

Red Hat Satellite uses HTTPS, which provides a degree of encryption and identity verification when communicating with a Red Hat Satellite Server. Satellite 6.7 does not support non-SSL communications.

Each Red Hat Satellite Server uses a self-signed certificate. This certificate acts as both the server certificate to verify the encryption key and the certificate authority (CA) to trust the identity of Satellite Server.

3.1.1. Configuring SSL Authentication
Copiar o link

Use the following procedure to configure an SSL authentication for the API requests to Satellite Server.

Procedure

  1. Obtain a certificate from the Satellite Server with which you want to communicate using one of the following options:

    • If you execute the command from a remote server, obtain a certificate using SSH: 

      $ scp root@satellite.example.com:/var/www/html/pub/katello-server-ca.crt ./
      Copy to Clipboard Toggle word wrap

    • If you execute the command directly on the Satellite Server, copy the certificate to the current directory: 

      $ cp /var/www/html/pub/katello-server-ca.crt ./
      Copy to Clipboard Toggle word wrap

  2. Use the API request with the --cacert katello-server-ca.crt option to verify the identity of the Satellite Server: 

    $ curl --request GET \
--user sat_username:sat_password \
--header "Accept:application/json" \
--cacert katello-server-ca.crt \
https://satellite.example.com/katello/api/organizations \
| python -m json.tool
    Copy to Clipboard Toggle word wrap

  3. Create a Network Security Services (NSS) database to store the katello-server-ca.crt certificate: 

    $ certutil -N -d sql:$HOME/.pki/nssdb
    Copy to Clipboard Toggle word wrap

  4. Permanently include the certificate in the NSS database: 

    $ certutil -d sql:$HOME/.pki/nssdb -A -t TC -n "Red Hat Satellite" \
-i katello-server-ca.crt
    Copy to Clipboard Toggle word wrap

  5. Verify that the certificate is present in the NSS database by entering the API request without the --cacert option: 

    $ curl --request GET \
--user sat_username:sat_password \
https://satellite.example.com/api/v2/hosts
    Copy to Clipboard Toggle word wrap

3.2. HTTP Authentication Overview
Copiar o link

All requests to the Satellite API require a valid Satellite user name and password. The API uses HTTP Basic Authentication to encode these credentials and add to the Authorization header. For more information about Basic Authentication, see RFC 2617 HTTP Authentication: Basic and Digest Access Authentication. If a request does not include an appropriate Authorization header, the API returns a 401 Authorization Required error

Important

Basic authentication involves potentially sensitive information, for example, it sends passwords as plain text. The REST API requires HTTPS for transport level encryption of plain text requests.

Some base64 libraries break encoded credentials into multiple lines and terminate each line with a newline character. This invalidates the header and causes a faulty request. The Authorization header requires that the encoded credentials be on a single line within the header.

3.3. OAuth Authentication Overview
Copiar o link

As an alternative to basic authentication, you can use limited OAuth 1.0 authentication. This is sometimes referred to as 1-legged OAuth in version 1.0a of the protocol.

To view OAuth settings, in the Satellite web UI, navigate to Administer > Settings > Authentication. The OAuth consumer key is the token to be used by all OAuth clients.

Satellite stores OAuth settings in the /etc/foreman/settings.yaml file. Use the satellite-installer script to configure these settings, because Satellite overwrites any manual changes to this file when upgrading.

3.3.1. Configuring OAuth
Copiar o link

To change the OAuth settings, enter the satellite-installer with the required options. Enter the following command to list all the OAuth related installer options: 

# satellite-installer --full-help | grep oauth
Copy to Clipboard Toggle word wrap

Enabling OAuth mapping

By default, Satellite authorizes all OAuth API requests as the built-in anonymous API administrator account. Therefore, API responses include all Satellite data. However, you can also specify the Foreman user that makes the request and restrict access to data to that user.

To enable OAuth user mapping, enter the following command: 

# satellite-installer --foreman-oauth-map-users true
Copy to Clipboard Toggle word wrap
Important

Satellite does not sign the header in an OAuth request. Anyone with a valid consumer key can impersonate any Foreman user.

3.3.2. OAuth Request Format
Copiar o link

Use an OAuth client library to construct all OAuth parameters. Every OAuth API request requires the FOREMAN-USER header with the login of an existing Foreman user and the Authorization header in the following format: 

--header 'FOREMAN-USER: sat_username' \
--header 'Authorization: OAuth oauth_version="1.0",oauth_consumer_key="secretkey",oauth_signature_method="hmac-sha1",oauth_timestamp=1321473112,oauth_signature=Il8hR8/ogj/XVuOqMPB9qNjSy6E='
Copy to Clipboard Toggle word wrap

Example

This example lists architectures using OAuth for authentication. The request uses a sat_username username in the FOREMAN-USER header. With the --foreman-oauth-map-users set to true, the response includes only architectures that the user has access to view. The signature reflects every parameter, HTTP method, and URI change.

Example request: 

$ curl 'https://satellite.example.com/api/architectures' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json,version=2' \
--header 'FOREMAN-USER: sat_username' \
--header 'Authorization: OAuth oauth_version="1.0",oauth_consumer_key="secretkey",oauth_signature_method="hmac-sha1",oauth_timestamp=1321473112,oauth_signature=Il8hR8/ogj/XVuOqMPB9qNjSy6E='
Copy to Clipboard Toggle word wrap
Voltar ao topo
Red Hat logoGithubredditYoutubeTwitter

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Ajudamos os usuários da Red Hat a inovar e atingir seus objetivos com nossos produtos e serviços com conteúdo em que podem confiar. Explore nossas atualizações recentes.

Tornando o open source mais inclusivo

A Red Hat está comprometida em substituir a linguagem problemática em nosso código, documentação e propriedades da web. Para mais detalhes veja o Blog da Red Hat.

Sobre a Red Hat

Fornecemos soluções robustas que facilitam o trabalho das empresas em plataformas e ambientes, desde o data center principal até a borda da rede.

Theme

© 2025 Red Hat