All;
I am not a developer so don't fully understand all of the configuration
points of apps and Tomcat. I am trying to understand the authN/authZ flow
for candlepin. I don't understand why I am prompted for a username and
password when accessing http[s]://<server>:<port>/candlepin/<something>.
The only places I know to look are web.xml and candlepin.conf. The web.xml
only specifies CLIENT-CERT authentication but tomcat is configured only for
"clientAuth=want" which shouldn't be mandatory. candlepin.conf has:
candlepin.auth.basic.enable = false
candlepin.auth.trusted.enable = false
candlepin.enable_cert_v3=true
candlepin.auth.oauth.enable = true
This seems to show that basic (username/password) authentication is
disabled. I'm assuming that a specification of some other form (cert) of
authentication must fall back to basic if it fails. Where is that
configured and where to the users and roles come from?
Thanks,
-LJK
