Foreman » Installer

Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=1449088

Description of problem:
After updating Satellite from 6.2.8 to 6.2.9.
We can no longer log in to the Satellite WEB-UI using Single Sign On with our smart cards.
We have located the source to our problem in /etc/httpd/conf.d/05-foreman-ssl.d/katello.conf

BugZilla 1367162 limits the URL scope of how the Apache webserver handles a SSL username supplied from the client. This change in katello.conf breaks the method of how we log in to the Satellite WEB-UI using our smart cards.

Detailed info =====================
https://bugzilla.redhat.com/show_bug.cgi?id=1367162
--- /etc/httpd/conf.d/05-foreman-ssl.d/katello.conf 2016-11-02 09:22:48.308639320 0100
++ /tmp/puppet-file20170502-25928-101m16o 2017-05-02 09:30:58.026811503 +0200
@ -3,7 +3,9 @ # CHANGES WILL LIKELY BE OVERWRITTEN. #

-SSLUsername SSL_CLIENT_S_DN_CN
<Location /pulp/api>
SSLUsername SSL_CLIENT_S_DN_CN
+</Location> =============================

Alias /pub /var/www/html/pub
 <Location /pub>

Can a broader URL scope (Location) that includes the login URL be applied or alternatively find another solution.

Customer got it working by changing these lines in /etc/httpd/conf.d/05-foreman-ssl.d/katello.conf

Removed this section
#<Location /pulp/api>

1. SSLUsername SSL_CLIENT_S_DN_CN
   #</Location>

Added this section
<LocationMatch /pulp/api|/users/extlogin>
SSLUsername SSL_CLIENT_S_DN_CN
</LocationMatch>

Version-Release number of selected component (if applicable):
Satellite 6.2.9

Actual results:
Smart card SSO not working after the change.

Expected results:
Smart card SSO working after upgrade.

Additional info: