Hammer CLI

Our shop does the same (requires client certs at the httpd level on the Foreman server), so hammer is consequently "broken" in favor of this security practice.

I've had a go at implementing it a while back in case anyone is interested:
https://github.com/rwf14f/hammer-cli-foreman/tree/server_client_cert_auth

It requires the changes in
https://github.com/rwf14f/hammer-cli-foreman/tree/server_verify_a
and
https://github.com/rwf14f/hammer-cli/tree/restclient_parameter_passing_a
for it to work (or the *_b branches).
I'm not sure whether it's still working at all though.

Nice! There were some changes in apipie-bindings and hammer and authentication very recently. That unfortunately means you will need to backport your patch. On the other hand it should make it easier to implement. I think you can leave off the hammer-cli part now.

It should be just matter of implementing another authenticator, like here:
https://github.com/theforeman/hammer-cli-foreman/blob/master/lib/hammer_cli_foreman/api/interactive_basic_auth.rb

and then modifying the foreman api connection:
https://github.com/theforeman/hammer-cli-foreman/blob/master/lib/hammer_cli_foreman/api/connection.rb

Unfortunately, you can't use those authenticators to implement SSL authentication because SSL is set up before they are called. The authenticators only have access to the http request object (Net::HTTP::Get) and not the actual http object (Net::HTTP) which would be required to modify any SSL options (see transmit method in RestClient's request.rb).
Currently, you have to pass the SSL options to the apipie-bindings API using its options hash which is not supported by the current hammer-cli implementation.

Looking at this again makes me wonder whether support for additional SSL options should be added to hammer-cli itself instead of the Foreman module.

I've had a go at adding the ssl options to hammer-cli itself and it works for me:

https://github.com/rwf14f/hammer-cli/tree/ssloptions

Cool, would you mind opening a pull request?

Done: https://github.com/theforeman/hammer-cli/pull/230