pulp/pulp — pull request #894 by jortel (2014-04-11 19:13:24+00:00)
Title: 1086437 - Fixes consumer reregistration.

https://bugzilla.redhat.com/show_bug.cgi?id=1086437

Basically using shared secret to authorize agent RMI requests. The secret is the database _id for the consumer document. This ensures that when a consumer is registered with the same name as a previously registered consumer, non of the requests targeted for the previously registered consumer are processed. Basically, the agent with authorize the RMI by ensuring the consumer _id passed in the request matches the *this* consumer.

This solution will be backwards compatible with existing consumer registrations which is fine since the problem only pertains to re-registrations.

Initially tried to solve this by having the consumer CLI generate a new keypair at each registration. As it turned out, this did not solve the problem. However, after discussion with bmbouter, decided it was a security improvement so decided to leave it in. Only ~3 lines of code.

Needed to update the certificate generation code on the server to properly differentiate the CN (common name) and the UID fields in the certificate subject DN (distinguished name). We were really passing the CN but calling it the *uid*. I needed it to support passing a *real* UID and including it in the subject so I tweaked the API.

Added a few missing tests and tests for what I added but the coverage is still not 100% on the Bundle class (dont have time to add what's missing).