Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

此内容没有您所选择的语言版本。

Chapter 3. API call authentication

Interaction with the Satellite API requires SSL authentication with Satellite Server CA certificate and authentication with valid Satellite user credentials. You can use the following authentication methods.

3.1. SSL authentication overview
复制链接

Red Hat Satellite uses HTTPS, which provides a degree of encryption and identity verification when communicating with Satellite Server. Satellite 6.18 does not support non-SSL communications.

By default, Satellite Server uses a self-signed certificate. This certificate acts as both the server certificate to verify the encryption key and the certificate authority (CA) to trust the identity of Satellite Server.

You can configure Satellite Server to use a custom SSL certificate. For more information, see Configuring Satellite Server with a custom SSL certificate in Installing Satellite Server in a connected network environment. For more information on disconnected Satellite Server, see Configuring Satellite Server with a custom SSL certificate in Installing Satellite Server in a disconnected network environment.

3.1.1. Configuring SSL authentication
复制链接

Configure an SSL authentication for the API requests to Satellite Server.

Procedure

  1. Obtain a certificate from your Satellite Server by using one of the following options:

    • If you plan to call the API from a remote server, download the CA certificate: 

      $ curl \
--output /etc/pki/ca-trust/source/anchors/satellite.example.com-katello-server-ca.crt \
http://satellite.example.com/pub/katello-server-ca.crt
      Copy to Clipboard Toggle word wrap

    • If you plan to call the API directly on your Satellite Server, copy the certificate to the /etc/pki/ca-trust/source/anchors directory: 

      # cp /var/www/html/pub/katello-server-ca.crt /etc/pki/ca-trust/source/anchors/satellite.example.com-katello-server-ca.crt
      Copy to Clipboard Toggle word wrap

  2. Add the certificate to the list of trusted CAs: 

    $ update-ca-trust extract
    Copy to Clipboard Toggle word wrap

Verification

  • Verify that your client trusts the Satellite SSL certificate by entering the API request without the --cacert option: 

    $ curl \
--request GET \
--user My_User_Name:My_Password \
https://satellite.example.com/api/v2/hosts
    Copy to Clipboard Toggle word wrap

3.2. HTTP authentication overview
复制链接

All requests to the Satellite API require a valid Satellite user name and password. The API uses Basic HTTP authentication to encode these credentials and add to the Authorization header. For more information about Basic authentication, see RFC 2617 HTTP Authentication: Basic and Digest Access Authentication. If a request does not include an appropriate Authorization header, the API returns a 401 Authorization Required error.

Important

Basic authentication involves potentially sensitive information, for example, it sends passwords as plain text. The REST API requires HTTPS for transport-level encryption of plain text requests.

Some base64 libraries break encoded credentials into multiple lines and terminate each line with a newline character. This invalidates the header and causes a faulty request. The Authorization header requires the encoded credentials to be on a single line within the header.

3.3. Token authentication overview
复制链接

Red Hat Satellite supports Personal Access Tokens that you can use to authenticate API requests instead of using your password. You can set an expiration date for your Personal Access Token and you can revoke it if you decide it should expire before the expiration date.

3.3.1. Creating a Personal Access Token
复制链接

Use this procedure to create a Personal Access Token.

Procedure

  1. In the Satellite web UI, navigate to Administer > Users.
  2. Select a user for which you want to create a Personal Access Token.
  3. On the Personal Access Tokens tab, click Add Personal Access Token.
  4. Enter a Name for you Personal Access Token.
  5. Optional: Select the Expires date to set an expiration date. If you do not set an expiration date, your Personal Access Token will never expire unless revoked.

  6. Click Submit. You now have the Personal Access Token available to you on the Personal Access Tokens tab.

    Important

    Ensure to store your Personal Access Token as you will not be able to access it again after you leave the page or create a new Personal Access Token. You can click Copy to clipboard to copy your Personal Access Token.

Verification

  1. Make an API request to your Satellite Server and authenticate with your Personal Access Token: 

    $ curl \
--user My_Username:My_Personal_Access_Token \
https://satellite.example.com/api/status
    Copy to Clipboard Toggle word wrap

  2. You should receive a response with status 200, for example: 

    {"satellite_version":"6.18.0","result":"ok","status":200,"version":"3.5.1.10","api_version":2}
    Copy to Clipboard Toggle word wrap

    If you go back to Personal Access Tokens tab, you can see the updated Last Used time next to your Personal Access Token.

3.3.2. Revoking a Personal Access Token
复制链接

Use this procedure to revoke a Personal Access Token before its expiration date.

Procedure

  1. In the Satellite web UI, navigate to Administer > Users.
  2. Select a user for which you want to revoke the Personal Access Token.
  3. On the Personal Access Tokens tab, locate the Personal Access Token you want to revoke.
  4. Click Revoke in the Actions column next to the Personal Access Token you want to revoke.

Verification

  1. Make an API request to your Satellite Server and try to authenticate with the revoked Personal Access Token: 

    $ curl \
--user My_Username:My_Personal_Access_Token \
https://satellite.example.com/api/status
    Copy to Clipboard Toggle word wrap

  2. You receive the following error message: 

    {
  "error": {"message":"Unable to authenticate user My_Username"}
}
    Copy to Clipboard Toggle word wrap
返回顶部
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

Theme

© 2025 Red Hat