opscode/chef — pull request #2411 by stevendanna (2014-11-13 12:51:14+00:00)
Title: Add --proxy-auth option to `knife raw`

Chef Server 12 and Enterprise Chef Server allow requests made on
behalf of other users by setting the x-ops-request-source HTTP header
to web and signing the request with a particular key (often known as
the "webui key").

This scheme allows the management console to make requests to the API
on behalf of the logged in user. However, it is also useful for
administrators attempting to debug their Chef Servers or helping their
users in large Chef Server installations.

For example, using the webui_key and this option, an adminstrator can
list nodes in different orgs, without access to a particular user's
key.

> knife raw /organizations/wonderbolts/nodes -k webui_priv.pem \
-u soarin -s https://api.opscode.piab --proxy-auth

{

}

> knife raw /organizations/acme/nodes -k webui_priv.pem
-u wei -s https://api.opscode.piab --proxy-auth

{

}

The webui key exists on the Chef Server itself and is only accessible
to an administrator with root access. As such, this is typically an
advanced debugging tool and isn't likely needed in other knife
subcommands.